AIRCRAFT ACCIDENT REPORT 3/2005

Department for Transport

Report on the serious incident to Boeing 757-236, G-CPER

on 7 September 2003

AIRCRAFT ACCIDENT REPORT 3/2005

Air Accidents Investigation Branch

Department for Transport

Report on the serious incident to Boeing 757-236, G-CPER

on 7 September 2003

This investigation was carried out in accordance with

The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996

© Crown Copyright 2005

Published with the permission of the Department for Transport (Air Accidents Investigation Branch). This report contains facts which have been determined up to the time of publication. This information is published to inform the aviation industry and the public of the general circumstances of accidents and serious incidents. Extracts can be published without specific permission providing that the source is duly acknowledged. Published 15 December 2005.

Printed in the United Kingdom for the Air Accidents Investigation Branch

(iii)

RECENT AIRCRAFT ACCIDENT AND INCIDENT REPORTS ISSUED BY THE AIR ACCIDENTS INVESTIGATION BRANCH

THE FOLLOWING REPORTS ARE AVAILABLE ON THE INTERNET AT

http://www.aaib.gov.uk 1/2004 BAe 146, G-JEAK February 2004 during descent into Birmingham Airport on 5 November 2000 2/2004 Sikorsky S-61N, G-BBHM April 2004 at Poole, Dorset on 15 July 2002 3/2004 AS332L Super Puma, G-BKZE June 2004 on-board the West Navion Drilling Ship 80 nm to the west of the Shetland Islands on 12 November 2001 4/2004 Fokker F27 Mk 500 Friendship, G-CEXF July 2004 at Jersey Airport, Channel Islands on 5 June 2001 5/2004 Bombardier CL600-2B16 Series 604, N90AG August 2004 at Birmingham International Airport on 4 January 2002 1/2005 Sikorsky S-76A+, G-BJVX February 2005 near the Leman 49/26 Foxtrot platform in the North Sea on 16 July 2002 2/2005 Pegasus Quik, G-STYX November 2005 at Eastchurch, Isle of Sheppey, Kent on 21 August 2004

(iv)

Department for Transport Air Accidents Investigation Branch Berkshire Copse Road Aldershot Hampshire GU11 2HH November 2005 The Right Honourable Alistair Darling Secretary of State for Transport

Dear Secretary of State

I have the honour to submit the report by Mr D S Miller, an Inspector of Air Accidents, on the circumstances of the serious incident to a Boeing 757-236, registration G-CPER, which occurred on the 7 September 2003. Yours sincerely David King Chief Inspector of Air Accidents

(v)

Contents

Glossary of abbreviations used in this report ...................................................................(ix)

Synopsis .................................................................................................................................. 1

1 Factual Information ........................................................................................................... 3

1.1 History of the flight .................................................................................................. 3

1.2 Injuries to persons .................................................................................................... 5

1.3 Damage to aircraft .................................................................................................... 5

1.3.1 Investigation of roll control problem ......................................................... 5

1.3.2 Investigation of hot oil/electrical burning smells....................................... 7

1.3.3 Autothrottle system .................................................................................... 8

1.4 Other damage ........................................................................................................... 8

1.5 Personnel information .............................................................................................. 9

1.5.1 Commander ................................................................................................ 9

1.5.2 First Officer ................................................................................................ 9

1.5.3 Licenced Aircraft Engineer ...................................................................... 10

1.5.4 Base Maintenance Technician.................................................................. 10

1.5.5 Certifying Technician............................................................................... 11

1.6 Aircraft information ............................................................................................... 11

1.6.1 Leading particulars................................................................................... 11

1.6.2 Wing trailing edge flap system description.............................................. 12

1.6.3 Engine oil storage and quantity indication............................................... 13

1.6.4 Engine bearing sealing and venting ......................................................... 14

1.6.5 Cabin pressurisation and air conditioning systems .................................. 15

1.6.6 Maintenance performed prior to flight..................................................... 15

1.6.7 Maintenance performed on the right wing ............................................... 16

1.6.7.1 Background...............................................................................16

1.6.7.2 Procedure for installing access panels ......................................18

1.6.7.3 Certification for fitment of panels 666AR and 666BR.............19

1.6.7.4 Location of job card racks ........................................................20

1.6.7.5 Environmental factors...............................................................21

1.6.8 Boeing 777 G-VIIA Air Driven Unit bay access door detachment ......... 21

(vi)

1.6.9 Engine oil servicing task .......................................................................... 22

1.6.9.1 Technician's role - engine oil servicing ....................................22

1.6.9.2 Certification of engine oil servicing task..................................24

1.6.10 Aircraft Maintenance Manual procedure for engine oil servicing........... 25

1.6.11 Maintenance Organisation's instructions for oil servicing....................... 26

1.6.12 Engine oil servicing procedures on the ramp........................................... 27

1.6.13 Quality Audit of engine oil servicing procedures .................................... 28

1.6.14 Previous history of oil smell problems..................................................... 29

1.6.15 Other recent Boeing 757 oil smell incidents ............................................ 31

1.7 Meteorological information.................................................................................... 31

1.8 Aids to navigation .................................................................................................. 31

1.8.1 Instrument Landing System (ILS), London Gatwick Runway 26L......... 31

1.9 Communications..................................................................................................... 31

1.10 Aerodrome information.......................................................................................... 32

1.11 Flight recorders ...................................................................................................... 33

1.11.1 FDR/CVR description.............................................................................. 33

1.11.2 Relevant UFDR Information.................................................................... 33

1.12 Wreckage and impact information ......................................................................... 34

1.13 Medical and pathological information ................................................................... 34

1.14 Fire ......................................................................................................................... 34

1.15 Survival aspects...................................................................................................... 34

1.16 Tests and research .................................................................................................. 34

1.17 Organisational and management information ........................................................ 36

1.17.1 The Airline's Safety Management System ............................................... 36

1.17.1.1 Tracking of safety issues ..........................................................38

1.17.1.2 Independent safety oversight ....................................................38

1.17.1.3 Implementation of safety recommendations.............................40

1.17.2 Requirements pertaining to aircraft maintenance .................................... 40

1.17.3 Certification of maintenance .................................................................... 41

1.17.4 JAR-145 Quality System requirements.................................................... 42

1.17.5 Philosophy of Quality Assurance............................................................. 43

1.17.6 Implementation of Quality Assurance in the Maintenance Organisation 43

(vii)

1.17.7 Non-Conformances .................................................................................. 45

1.17.8 Engineering Quality Services Department............................................... 45

1.17.9 Quality department (EQS) oversight of maintenance activities............... 47

1.17.10 The Airline's internal safety investigations.............................................. 47

1.17.10.1 Background...............................................................................47

1.17.10.2 EQS Quality Investigation findings..........................................48

1.17.10.3 Corrective actions taken by the Maintenance Organisation .....49

1.17.11 Principles of Maintenance Error Investigation (MEI) ............................. 49

1.17.12 G-CPER Maintenance Error Investigation .............................................. 50

1.17.13 The Management perspective .................................................................. 51

1.17.14 Technical training..................................................................................... 52

1.17.15 Organisation and supervision of maintenance staff ................................. 53

1.17.16 Flight crew actions ................................................................................... 54

1.18 New investigation techniques................................................................................. 54

2 Analysis ............................................................................................................................. 55

2.1 Roll control problem .............................................................................................. 55

2.2 Hot oil/electrical burning smells ............................................................................ 55

2.3 Conduct of the maintenance ................................................................................... 56

2.3.1 General ..................................................................................................... 56

2.3.2 Procedure for controlling access panels................................................... 57

2.3.2.1 General......................................................................................57

2.3.2.2 Flap panels 666AR and 666BR ................................................57

2.3.3 Engine oil servicing procedures ............................................................... 59

2.3.4 Behaviour and actions of the LAEs ......................................................... 59

2.3.4.1 Panels 666AR and 666BR ........................................................59

2.3.4.2 Certification for engine oil servicing task ................................60

2.4 The Maintenance Organisation's Quality Assurance Programme.......................... 60

2.5 Supervision and organisation of hangar staff ......................................................... 61

2.6 Similarities between the B777 (G-VIIA) and G-CPER incidents.......................... 62

2.7 Conduct of the Maintenance Error Investigation ................................................... 62

2.8 Role of the Safety Services Department ................................................................ 63

2.9 Consequences of failing to install or secure critical panels ................................... 64

2.10 Flight crew actions ................................................................................................. 64

(viii)

3 Conclusions ....................................................................................................................... 65

(a) Findings .................................................................................................................. 65

(b) Causal Factors ........................................................................................................ 68

4 Safety Recommendations................................................................................................. 69

5 Airline's response to Safety Recommendations............................................................. 70

APPENDICES

1 Job Cards for fitment of R/H outboard flap panels 666AR and 666BR

2 Daily Check Inspection Sheet (engine oil servicing task highlighted)

3 Boeing 757 AMM Panel Chart showing location of Panels 666AR and 666BR

4 RB211 Engine Oil System Schematic

(ix)

GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT

AAIB Air Accidents Investigation Branch

ADU Air Driven Unit AMM Aircraft Maintenance Manual APU Auxiliary Power Unit ATC Air Traffic Control BMA Base Maintenance Authorisation BSRC Board Safety Review

Committee CAA Civil Aviation Authority CRS Certificate of Release to Service CSD Cabin Service Director/Constant

Speed Drive CVR Cockpit Voice Recorder EEC Engine Electronic Controller EICAS Engine Indicating and Crew

Alerting System EPR Engine Pressure Ratio EQS Engineering Quality Services FDR Flight Data Recorder FL Flight Level FMA Full Maintenance Authorisation FO First Officer GFOR Ground Found Occurrence

Report HP High Pressure hrs hours IAS Indicated Airspeed ICAO International Civil Aviation

Organisation

IDG Integrated Drive Generator ILS Instrument Landing System JAR Joint Airworthiness

Requirements kt knot(s) LAE Licenced Aircraft Engineer L/H Left-hand LMA Limited Maintenance

Authorisation LP Low Pressure MEI Maintenance Error Investigation MHz Megahertz mm millimetre(s) nm Nautical mile(s) PF Pilot Flying PLC Public Limited Company PNF Pilot Not Flying QA Quality Assurance QAP Quality Assurance Programme R/H Right-hand RFFS Rescue and Firefighting

Services RMA Ramp Maintenance

Authorisation TBD Technical Block 'D' UFDR Universal Flight Data Recorder UTC Universal Time Co-ordinated VRef Approach airspeed ºC Degrees Celsius

1

Air Accidents Investigation Branch

Aircraft Accident Report No: 3/2005 (EW/C2003/09/01)

Registered Owner and Operator: British Airways PLC

Aircraft Type and Model: Boeing 757-236

Registration: G-CPER

Place of Incident: During the climb after departure from London Heathrow and on approach to land at London Gatwick

Date and Time: 07 September 2003 at 1805 hrs

(All times in this report are UTC, except as stated)

Synopsis

The incident was notified to the Air Accidents Investigation Branch (AAIB) at 2045 hrs on 7 September 2003. The investigation, which began early the following morning, was conducted by:

Mr D S Miller (Investigator in Charge) Mr R G Ross (Engineering) Mr P Hannant (Operations) Mr A Foot (Flight Recorders)

The incident to the Boeing 757 aircraft occurred on the first flight following a 26-day major maintenance check. Shortly after takeoff on a scheduled passenger flight from London Heathrow to Paris, a hot oil smell, that had been present in the cockpit on engine startup, returned. The flight crew donned oxygen masks and immediately diverted to London Gatwick Airport. During the autopilot-coupled ILS approach to Gatwick, the aircraft drifted to the right of the localiser after selection of Flap 30. When the autopilot was disconnected, a large amount of manual left roll control was needed to prevent the aircraft from turning to the right. It was necessary to maintain this control input until touch down. The aircraft landed safely despite these difficulties, with no injuries to any of the passengers or crew.

2

The investigation determined that the incident had been caused by maintenance errors that had culminated in the failure to reinstall two access panels, 666AR and 666BR, on the right-hand outboard flap and incorrect procedures being used to service the engine oils. The events were the result of a combination of errors on the part of the individuals involved and systemic issues, that had greatly increased the probability of such errors being committed.

The following immediate causal factors were identified:

1. The tasks of refitting the panels to the right wing and correctly certifying for the work carried out were not performed to the required airworthiness standard.

2. Ineffective supervision of maintenance staff had allowed working practices to develop that had compromised the level of airworthiness control and had become accepted as the 'norm'.

3. There was a culture, both on the ramp and in the maintenance hangar, which was not effective in ensuring that maintenance staff operated within the scope of their company authorisation and in accordance with approved instructions.

4. The maintenance planning and task instructions, relating to oil servicing on the Boeing 757 fleet, were inappropriate and did not ensure compliance with the approved instructions.

5. The Airline's Quality Assurance Programme was not effective in highlighting these unsatisfactory maintenance practices.

Eight safety recommendations are made in this report, with the intention of preventing similar incidents in the future.

3

1 Factual Information

1.1 History of the flight

Having arrived at the aircraft, the commander liaised with the Cabin Service Director (CSD) and then entered the flight deck to begin preparations for the flight. The First Officer (FO) carried out the pre-flight inspection and then joined the commander on the flight deck. It was noted from the Technical Log that this was the first flight following major maintenance but there were no special requirements or any deferred defects. The Auxiliary Power Unit (APU) was started and the air conditioning packs selected ON. All checks progressed normally.

The right engine was started during the push back and shortly afterwards a smell of hot oil became noticeable on the flight deck. The commander had experienced this before and with all the right engine indications normal, the left engine was started. The flight deck crew discussed the hot oil smell, but they were not concerned about it at that point. After the tug had been disconnected and thrust increased on both engines to commence the short taxi for Runway 27L the hot oil smell disappeared.

After takeoff the aircraft, with the FO operating as the pilot flying (PF) followed the 'Midhurst 3G' Standard Instrument Departure. Shortly after lift off the hot oil smell returned; stronger than before. The crew had a brief discussion about the smell and the commander, operating as Pilot Not Flying (PNF) donned his oxygen mask. The smell worsened as the aircraft continued its climb so the FO also went onto oxygen. The pilots established communication with each other and then informed Air Traffic Control (ATC) that they had fumes in the cockpit, were on oxygen and wished to return to Heathrow. ATC instructed them to level at FL180 offering the options of returning to Heathrow or diverting to London Gatwick. The commander called the CSD on the interphone and asked him if the smell had been detected in the passenger cabin. The cabin crew in the forward cabin had become aware of a smell that they described as electrical burning. With this additional information the commander elected to divert to Gatwick; the nearest suitable airfield.

The CSD was again called on the interphone and given a 'NITS' (Nature, Intentions, Time and Special instructions) briefing for the landing at Gatwick. The 'SMOKE OR FUMES AIR CONDITIONING' emergency checklist was actioned and the cabin outflow valve opened as the aircraft descended below 10,000 feet in order to purge the cabin and flight deck of the fumes that were still present.

4

The aircraft was radar vectored towards Biggin Hill to comply with the commander's request for a 25 nm track distance to touchdown. The commander consulted the approach plates for Gatwick and gave an abbreviated briefing to the FO for an autoland using the Instrument Landing System (ILS) on Runway 26L. This was in accordance with the Airline's Standard Operating Procedures (SOP's) when operating on oxygen.

The aircraft, with the right autopilot and auto thrust engaged, was configured for landing early during the approach with Flap 1 and then Flap 5 being selected on the speed schedule. When the localiser had been captured, the 'Approach' mode was armed and the remaining two autopilots were engaged. As the aircraft levelled at 3,000 feet, there was no increase in thrust as expected and the FO noticed that the Indicated Airspeed (IAS) was reducing. Autothrottle response appeared sluggish, so the FO advanced the thrust levers manually to 1.3 EPR (Engine Pressure Ratio). The engines seemed slow to respond but when the FO engaged the 'Speed' mode, the autothrottle applied the appropriate thrust setting. The landing gear was then selected down, the speed reduced and Flap 20, 25 and finally Flap 30 lowered for the autopilot coupled approach.

The runway was clearly visible at 10 nm and the FO monitored the progress both from the flight instruments and the visual picture. He noticed that the aircraft however, was drifting to the right of the runway centreline and this was confirmed by a full 'fly left' indication on the localiser and lateral guidance flight director bar. He informed the commander and stated that he would disconnect the autopilot. As he did so he needed to apply some 40° of left control column to maintain wings level.

The FO applied a small amount of left rudder, which assisted in turning the aircraft back onto the localiser. Because the control inputs were symptomatic of an engine failure, the crew checked the Engine Indicating and Crew Alerting System (EICAS) display, noting that all engine parameters were normal. At this point the commander took control of the aircraft. He checked that the control trim and flap positions were normal and increased the VRef speed from 125 kt to 145 kt in order to expedite the approach. The commander continued the approach visually, cross checking the ILS information presented on the flight director whilst the FO checked the EICAS lower display noting that an estimated 75% of left aileron was being applied.

The Gatwick Approach controller had provided radar vectors for the approach and offered to issue the landing clearance but this was declined and the crew transferred to the Gatwick Tower frequency. Having been advised by the crew of the control difficulties the tower controller passed the surface wind of 220°/5 kt and cleared the aircraft to land. During the flare, the offset control

5

column position was maintained and the aircraft touched down initially on the left main landing gear. Autobrake level '4' and full reverse thrust were used to stop the aircraft.

After touchdown ATC informed the crew that there had been smoke visible under the wing area. The commander thought that this was probably tyre smoke but having obtained the Rescue and Firefighting Services (RFFS) frequency from the Tower he spoke to the fire officer who had seen smoke from the area of the landing gear. The crew shut down the right engine and started the APU before shutting down the left engine.

The flight deck direct vision (DV) windows were opened and the flight crew removed their oxygen masks. The commander spoke to the CSD on the interphone and instructed him to maintain the cabin crew at their doors and then spoke to the passengers to explain the situation. It was agreed with the RFFS that the aircraft would be towed to a remote stand and the passengers disembarked normally. Whilst parked on the runway an 'EQUIPMENT OVERHEAT' warning appeared which required the equipment cooling selector switch to be placed in the alternate position.

The aircraft was towed to Stand 171 and the passengers disembarked. After the incident, the aircraft was towed to the Airline's maintenance base where it was secured, and later examined by the AAIB assisted by engineers from the Airline.

1.2 Injuries to persons

There were no injuries to any persons.

1.3 Damage to aircraft

The aircraft was not damaged however, various anomalies were found that had compromised its airworthiness.

1.3.1 Investigation of roll control problem

On examining the aircraft with the flaps down, access panels 666AR and 666BR were found to be missing from the outboard flap on the right wing (Figure 1). The panels are approximately 300 mm x 200 mm in size and are installed at the forward attachments for the main flap. Their purpose is to maintain the aerodynamic profile of the flap leading edge.

The panels had not been refitted during the recent maintenance. They were found on a storage rack in Hangar Bay 13 in Technical Block 'D' ('TBD') at

6

London Heathrow, where the maintenance had been performed. The panels were tagged with 'Temporarily Removed for Access' labels and the attaching screws were found in bags tied to the panels (Figure 2). Examination of the maintenance records showed that the job cards to install the panels had been stamped to certify that the panels had been fitted (Appendix 1). Both job cards had been certified by the same individual. There was no requirement for the panels to be independently inspected after fitting, as they are not considered to be safety critical items.

Figure 1 G-CPER R/H Outboard Flap showing locations of missing access panels

666AR and 666BR

Figure 2 Flap Panels 666AR and 666BR, found on storage racks in 'TBD' Bay 13 Hangar

666BR

666AR

7

Testing and examination of the flight control and autopilot systems did not identify any defects that could have caused the roll control problem.

After fitting the missing panels, a proving flight was made to verify the integrity of the aircraft before returning it to passenger service. This proved satisfactory, with no reported handling problems with flaps up or down.

1.3.2 Investigation of hot oil/electrical burning smells

The cabin, galley and lavatory utility services were extensively operated, but this failed to produce any unusual smells.

Investigation of the 'EQUIPMENT OVERHEAT' warning revealed that circuit breaker 'B2' on the P70 panel in the forward equipment bay had tripped. This circuit breaker is for the No 2 aft equipment cooling exhaust fan. There are two such fans located in the aft cargo compartment, towards the rear of the aircraft. The fans draw air from the rear lavatory and rear galley, to vent these areas. Strip examination of the No 2 fan showed that the impeller was partly seized with a sticky blue residue that appeared to be a mixture of grease and lavatory fluid. There was no evidence of overheating and the fan ran normally once the residue was removed.

Examination of the APU did not identify any oil leaks. (The APU has the potential to cause oil smells if oil should leak past the compressor seals into the bleed air supply). No unusual smells could be detected when using the APU bleed air source. However, when engine bleed air was selected, a smell of hot oil emanated from the cockpit air vents at higher engine power settings. The left and right engine bleed air sources were selected in turn to try and identify which engine was producing the smell, but this proved inconclusive. No unusual smells were detected within the passenger cabin. The air-conditioning packs were then purged with APU bleed air to remove any oil that may have accumulated in the ducting.

The engine oil contents were checked on the oil tank sight glass shortly after the engine runs. The left engine was found to contain 17 litres of oil and the right engine 20 litres. The oil level on the right engine was close to the 'FULL' graduation on the sight glass. The company engineers considered that the right engine oil quantity was excessive and drained two litres of oil from the engine to reduce it to a more acceptable amount. (Due to a history of oil smells in the cockpit/cabin on its Boeing 757 fleet, the Airline had adopted a policy of reducing the maximum oil fill level to one litre below the 'FULL' graduation. This was intended to reduce the potential for overfilling; a known cause of oil smells in the cabin and cockpit.)

8

The aircraft was returned to service after completion of this work.

A further incident of oil smells in the cockpit was reported on 10 September 2003. Troubleshooting on this occasion did not identify any defects with the aircraft and it was returned to service. A further event on 21 September, on approach to London Heathrow, resulted in the crew declaring a 'PAN' and donning oxygen masks. Maintenance action on this occasion included the removal of the left engine, which had a history of high oil consumption. (The air supply to the cockpit is normally provided by the left engine.)

The engine, serial number 31518, was tested and strip examined by the manufacturer, Rolls-Royce, at their facility in Derby. This was overseen by the AAIB. Despite extensive testing and examination, no defects were found that could have resulted in oil leakage into the cabin air supply path.

A review of the aircraft's maintenance history showed that it had a history of oil smells in the cockpit/cabin dating back to April 2003. The smells usually occurred shortly after engine start or during takeoff. The APU was removed on 29 July 2003 to eliminate one potential source of the problem. Tests conducted by the APU manufacturer failed to identify any defects that could have produced the oil smells.

1.3.3 Autothrottle system

Prior to starting the engines on the ground runs, the 'R EEC INOP' and 'R ENG LIMITER' legends illuminated on the right Engine Electronic Controller (EEC) selector switch. Diagnostic checks highlighted a fault with the EEC, which displayed fault codes 31 and 35. The unit (Part No PL3311, Serial No BX5470) was removed for workshop testing. This confirmed a number of internal faults that could have accounted for the anomalous performance of the autothrottle system, but this issue was not pursued any further as it was not causal to the incident.

1.4 Other damage

None.

9

1.5 Personnel information

1.5.1 Commander: Male, age 46 years

Licence: Airline Transport Pilot's Licence

Aircraft ratings: Boeing 757, 767, 737 100-200

Instrument rating: 30 October 2002

Licence Proficiency Check: 30 October 2002

Operational Proficiency Check: 27 April 2003

Line Check: 6 May 2003

Medical Certificate: 30 May 2003

Flying Experience: Total flying: 9,644 hours

On type: 2,787 hours

Last 90 days: 111 hours

Last 28 days: 52 hours

Last 24 hours: 5 hours

1.5.2 First Officer: Male, age 36 years

Licence: Commercial Pilot's Licence

Aircraft ratings: Boeing 757, 767, BAe ATP

Instrument rating: 20 April 2003

Licence Proficiency Check: 20 April 2003

Operational Proficiency Check: 20 April 2003

Line Check: 15 May 2003

Medical Certificate: 14 February 2003

Flying Experience: Total flying: 694 hours

On type: 211 hours

Last 90 days: 139 hours

Last 28 days: 21 hours

Last 24 hours: 8 hours

10

1.5.3 Licenced Aircraft Engineer: Male, aged over 18 years (Certified for engine oil servicing task)

Location/shift: Hangar Bay 13, Technical Block 'D', LHR, Shift 'CCB' - 12 hour day shift

Licence: JAR-66 Category B1 Aircraft Maintenance Licence

Relevant approvals: Full Maintenance Authorisations (FMA) on B737/B757/B767 types

Experience: Several years experience in a heavy maintenance environment

Recent duty Pattern: 12 hour day shift

The LAE was appropriately trained and qualified in accordance with the JAR-145.35 Requirement for Certifying Staff. He had completed the mandatory two-yearly Continuation Training on 6 August 2002.

1.5.4 Base Maintenance Technician: Male, aged 45 years (Performed engine oil servicing task)

Location/shift: Hangar Bay 13, Technical Block 'D', LHR, Shift 'CCB' - 12 hour day shift

Licence: JAR-66 Category A3 Aircraft Maintenance Licence

Relevant approvals: Limited Maintenance Authorisations (LMA) on Boeing B747-400 (RB211) & B777-200 (GE90/Trent)

Experience: 12.5 years Boeing 747/757 heavy maintenance experience at LGW and LHR

Recent duty Pattern: 12 hour day shift

The technician was appropriately trained and qualified in accordance with the JAR-145.35 Requirement for Certifying Staff. He was authorised to perform certain tasks on the Boeing 757, but as he did not hold any approvals on the type, he could not certify for these tasks.

11

1.5.5 Certifying Technician: Male, aged 43 years (Certified for the installation of flap access panels 666AR and 666BR)

Location/shift: Hangar Bay 13, Technical Block 'D', LHR Shift 'CCB' - 12 hour day shift

Licence: JAR-66 Category A4 Aircraft Maintenance Licence

Relevant approvals: Limited Maintenance Authorisations (LMA) on Boeing 757-200 (RB211) and Airbus A319/320/321 (CFM56/V2500)

Experience: 14 years aircraft maintenance experience. Last 3 years primarily involved in 757 heavy maintenance in Hangar Bay 13 Technical Block 'D', LHR

Recent duty Pattern: 12 hour dayshift

The technician was appropriately trained and qualified in accordance with the JAR-145.35 Requirement for Certifying Staff. He had completed the mandatory two-yearly Continuation Training on 28 January 2003.

1.6 Aircraft information

1.6.1 Leading particulars:

Registration: G-CPER

Type: Boeing 757-236

Serial Number: 29113

Year of Manufacture: 1997

Airframe life at time of incident: 13,775 hours/7,865 landings

Engines: 2 Rolls-Royce RB211-535E4-37 turbofan engines

Serial Numbers: L/H: 31518

R/H: 30735

Hours/cycles: L/H: 13,775/7,865

R/H: 16,568/15,773

The left engine was installed at aircraft build; the right engine was installed in 2002. The aircraft held a valid Certificate of Airworthiness.

12

1.6.2 Wing trailing edge flap system description

The Boeing 757 is equipped with hydraulically-powered trailing edge flaps and leading edge slats that provide increased lift for takeoff and landing. There are two flaps on each wing, an inboard and an outboard. Each flap consists of a main flap and an aft flap. Each flap is attached to two carriages, which in turn ride in flap tracks that determine the angle that the flap makes with the wing.

When fully retracted, the upper surfaces of the main flaps are partly covered by the wing spoiler panels. The flap drive mechanisms are enclosed within aerodynamic fairings. When the flaps are extended to the landing position (normally 25° or 30°), the leading edges of the main flaps move out from underneath the spoiler panels and are exposed to the airflow.

The outboard flap forward attachments to the flap carriages are accessed by removing panels 666AR and 666BR. The panels are secured to the main flap with screws secured by anchor nuts. The panel identification numbers are ink stamped on the inside of the panels. The location of the panels is illustrated in Chapter 06-44-00 of the Boeing 757 Maintenance Manual (Appendix 3). These panels are almost completely hidden by the flap drive fairings when viewed from below and the wing spoiler panels from above, when the flaps are retracted. However, they are clearly visible when the flaps are extended. Figure 3 shows the comparative visibility of the panels with flaps up and flaps down.

Figure 3 Relative visibility of missing flap access panels, flaps down and flaps up

Missing Panel 666AR/BR

Flap drive fairing FWD

FLAPS DOWN

FLAPS UP

13

1.6.3 Engine oil storage and quantity indication

The reservoir for the engine oil system consists of a tank of nominal capacity 20 litres, which is mounted on the right side of the fan case. It is accessed via an access door on the right side of the fan cowl. A sight glass (Figure 4) allows the oil quantity to be visually checked and the oil may be topped up via a quick-release filler cap. An electronic quantity transmitter mounted in the centre of the tank provides a signal to the lower EICAS display in the cockpit. The display indicates to the flight crew each engine oil quantity in litres, up to a maximum of 20. Although the oil tank is capable of holding more than this, the EICAS display will not reflect this, nor does it provide any indication that the tank is overfull.

The sight glass is marked with a 'FULL' level (corresponding to approximately 20 litres) and is graduated in litres and US quarts required to top up to the full mark. Thus an oil level corresponding to the '3' on the 'litres' scale means that three litres of oil are required to top up to the 'FULL' mark.

Oil is prevented from draining out of the oil tank and down into the high speed external gearbox under gravity by a carbon seal within the pressure pump. Service experience shows however, that over a period of several hours oil can leak past the carbon seal and this, in conjunction with thermal contraction of the oil as it cools, may cause the oil level on the sight glass to drop, typically by about one litre over a period of several hours. For this reason, the 757 Aircraft Maintenance Manual instructions require that the engine oil level be checked between ten minutes and one hour of engine shutdown.

Figure 4 Engine oil tank sight glass

14

A trial performed on G-CPER's left engine, which was test run prior to strip examination at Rolls-Royce Derby, showed that the oil level on the sight glass decreased by ¾ litre over a period of 12 hours after engine shut down.

1.6.4 Engine bearing sealing and venting

The engine main shaft bearings are sealed by a combination of labyrinth and grooved air seals. The seals rely on pressurised air taken from the intermediate compressor acting on the external side of the seals to prevent oil leakage from the bearings.

The oil tank and main shaft bearing chambers (with the exception of the Low Pressure (LP) turbine bearing chamber which is not vented) are interconnected through internal and external tubes to vent through a centrifugal breather. This prevents any pressure build-up in these compartments due to the ingress of pressurising air through the bearing air seals. The breather consists of a multi-vaned rotor located in a housing attached to the high-speed external gearbox. When the oil/air mist contacts the breather rotor, the oil is separated into an annular groove in the breather housing and drains back to the high speed external gearbox via internal passages. The air is directed forward through slots in the rotor and is vented overboard to atmosphere through a vent pipe that exits at the rear of the engine. A schematic of the engine oil system is shown in Appendix 4.

Service experience has shown that overfilling the engine with oil can cause the slots in the breather to become partially blocked with oil. Although the excess oil is eventually vented overboard through the breather, in the interim it causes the air pressure in the vent system to rise. This increases the air pressure in the bearing chambers. The pressure differential between the air in the bearing chambers and the external sealing air causes oil to be forced outward, past the bearing air seals. Oil leaking out of the LP shaft front bearing seals can enter the compressor drum and be centrifuged outwards and will eventually find its way into the compressor air path. The oil mist produced may be drawn into the bleed air supply via the High Pressure Compressor bleed air off-takes and then fed into the cabin air conditioning system, generating hot oil smells and fumes in the cockpit and passenger cabin. Once the excess oil has vented overboard, the breather becomes unblocked, the air pressure in the vent system drops and the oil leakage and smells in the cockpit and cabin cease. The oil in the compressor and the gas path is 'washed away' by the high flow rate of air through the compressor, leaving no evidence of leakage.

15

1.6.5 Cabin pressurisation and air conditioning systems

The cabin pressurisation, air conditioning and various other systems on the aircraft require pressurized air, which is supplied by the engines. A small amount of high pressure air is bled from Stages Two (HP2) and Six (HP6) of the High Pressure Compressor on each engine. This bleed air is routed through pre-coolers, where it is cooled, then pressure-regulated, before being supplied to the various user systems.

Bleed air from the left and right engines is used to supply the left and right air-conditioning packs, respectively. These cool and condition the air for passenger comfort. The conditioned air from both packs is combined in a mix manifold, together with recirculated air from the cabin, before being ducted to the cabin. The cockpit receives a dedicated supply of conditioned air from the left pack duct, taken from a point upstream of the mix manifold. The aircraft is normally operated with both air conditioning packs switched on, however it is permissible to operate with either pack inoperative, subject to certain restrictions.

1.6.6 Maintenance performed prior to flight

The incident flight was the first flight following the completion of an 'Inter 4' heavy maintenance check. The maintenance was performed by the Airline's JAR-145 approved Maintenance Organisation and commenced on 11 August 2003 and was completed on schedule, on 7 September 2003. The work was carried out in the Airline's Boeing 757/767 heavy maintenance facility in Technical Block 'D' ('TBD') at London Heathrow Airport. The aircraft was parked in Bay 13 of this hangar for the duration of the maintenance and was surrounded by purpose-built movable, multi-level staging, permitting safe and convenient access to different parts of the aircraft (Figure 5).

The work involved an extensive overhaul of the aircraft and its systems, including replacement of the leading edge slats due to previous hail damage. Disturbance of the engine oil system was limited to replacement of the oil filters. The aircraft was not test flown following the maintenance as there was no requirement to do so.

16

Figure 5 Boeing 757 docked in staging - Hangar Bay 13, Technical Block 'D'

1.6.7 Maintenance performed on the right wing

1.6.7.1 Background

The maintenance on the right wing was performed by two separate crews, working alternating 12-hour day shift patterns (shifts 'CCA' and 'CCB'), consisting of four days on duty, followed by a four-day rest period. Different crews had worked on the left wing. Each crew comprising of a half a dozen or so technicians, was led by a Licenced Aircraft Engineer (LAE), who provided technical leadership, but did not act in a man-management capacity. (The crews were not permanently constituted, but would be formed anew for each aircraft maintenance input.) The task of installing the access panels on the right wing fell to the crew on Shift 'CCB', who came back on duty in the final few days of the maintenance.

Most of the heavy maintenance tasks on the aircraft (including panel removal and refit) were controlled via job cards, containing the instructions for performing the required maintenance, as specified in the Approved Maintenance Programme for the aircraft type. The job card data were held in an electronic database known as the 'OMEGA' system. The job cards included boxes for engineers to stamp, to signify completion of certain stages of the task and completion of the task in its entirety. When certified with an engineer's stamp,

17

the job cards serve as a record that the work has been completed in accordance with approved data (ie the Aircraft Maintenance Manual and applicable company procedures). A correctly completed set of job cards forms an integral part of the chain of accountability that enables the final declaration of airworthiness, the Certificate of Release to Service, to be issued. Each Certifying Technician and LAE has a unique stamp number, so that it is possible to identify who performed a particular task.

The job cards for the scheduled tasks on a maintenance input were printed and collated into a 'work pack' by the Production Planners, before being issued to the Production Control office in the hangar. The cards were then placed in racks, ready for the aircraft's arrival in the hangar. The job cards were segregated in the racks according to aircraft zone.

The aircraft was 'de-panelled' soon after the start of the maintenance check, to allow access for inspection, lubrication and for other such tasks to be performed. The removed panels were tagged with 'TEMPORARILY REMOVED FOR ACCESS' labels, on which were recorded the aircraft registration, date of removal and the location of the panel on the aircraft. The labels were used for identification purposes only and not as a method of controlling the removal and refit of the panels. They were not cross-referenced in any maintenance documentation. Although there are fields on the label for recording the associated panel job card details and for the stamp of the person removing the panel, these as a rule, were not used. The tags found attached to panels 666AR/666BR were both dated 14 August 2003, probably signifying the date that they were removed from the aircraft. As there was no identifying stamp on the tags, it is not known who had removed them.

The leading edge slats were required to be replaced due to hail damage and the cuff panels from the slats were removed with the understanding that they had to be transferred over to the replacement slats. In the event, the replacement slats were delivered from stores with cuff panels already fitted. The removed cuff panels, that were subsequently no longer required, were not immediately returned to stores, but remained on the racking near the right wing tip, where the removed flap panels 666AR/666BR had also been placed. By coincidence, the flap panels are very similar in appearance to the slat cuff panels and they are difficult to differentiate at a glance.

Although the hangar storage racking was inspected at the completion of the maintenance as part of established good housekeeping practices, the missing flap panels were not identified.

18

1.6.7.2 Procedure for installing access panels

The Certifying Technician who certified the job cards for fitting panels 666AR and 666BR co-operated fully with the investigation.

He described the normal procedure used in the hangar for refitting panels. The refitting of panels is one of the last tasks to be performed before the aircraft leaves the hanger at the end of its maintenance. Before the panels can be installed, the LAE responsible for that zone of the aircraft first satisfies himself that all the necessary maintenance has been completed. He then stamps the job cards to authorise clearance to fit the panels, before instructing his crew to fit them. The normal approach to this task is to select a panel and match it up with the appropriate 'hole' in the aircraft. If the technicians are unsure of where a panel is fitted, they consult the panel diagrams in the Aircraft Maintenance Manual. This process is repeated until all of the panels have been installed. Given the large number of panels, the task of re-panelling a wing usually takes two to three days. Some LAE's examine the wing after the technicians have installed the panels, but others trust them to have completed the job satisfactorily.

The task of certifying for the panels is normally attended to after they have all been fitted. Thus considerable time might elapse between a panel being fitted and its job card being stamped. The cards are usually stamped by two or three technicians in one session. This might be done at the end of a shift, the following day, or even later. The technician stated that he often had to recall from memory which panels he had fitted and that his memory was sometimes blurred by the fact that he may have assisted other members of his crew in fitting some of the larger panels.

According to the technician, this method of working is not unusual when performing simple, repetitive tasks such as fitting access panels. However, with a discrete task, such as changing a hydraulic pump, it is more usual to stamp the job cards as soon as the task has been completed. He believed that with repetitive tasks, the remoteness of the job card racks from the work location discouraged people from going to the racks to stamp the job card as each task was completed, due to the amount of time that would be wasted.

19

1.6.7.3 Certification for fitment of panels 666AR and 666BR

The Category A4 Certifying Technician's company approvals gave him the authority to 'self-certify' certain types of maintenance tasks, for example, the fitting of access panels. Such tasks could be performed entirely by him, including certification of the task, without the need for an independent inspection. In paragraph 5.5.1 of the company's Technical Procedure TP-Q-8.1.1-01 (Issue 19), it is stated that a holder of an A4 Maintenance Authorisation 'May only certify for work providing they were personally involved in performing the completed task.' By inference, he was not authorised to certify (ie 'stamp') for other people's work. The use of self-certification for tasks perceived as 'non-critical' has become common practice in the airline maintenance industry, with the move away from the previous regime of Quality Control to one of Quality Assurance. (The former required 100% inspection of all tasks performed on the aircraft, whereas the latter operates on the principle of having robust procedures in place that are strictly followed, with only those tasks that are deemed critical requiring independent inspection.)

The technician recalled having fitted a large number of panels on the right wing in the areas of the leading edge, trailing edge and upper and lower surfaces. However, he could not remember specifically which panels he had installed. Whilst the panels were being installed, functions of the aircraft systems were in progress. This included the operation of the flaps and he and his colleagues had to integrate their tasks with this.

After all of the panels had been installed, the LAE reminded his crew to stamp the job cards to certify for completion of the tasks, as this had not yet been completed. The technician recalled being given a batch of job cards by his LAE, with the instruction to 'clear what you can'. He began by stamping the job cards to certify for the panels that he could remember having fitted. For those that he was less sure of, he referred to the panel diagrams in the 757 Aircraft Maintenance Manual, and attempted to physically locate the panels on the wing, to confirm that they had been installed. He recalled visiting the right wing on two or three occasions during the course of clearing the cards. At the end of this process, there were a few job cards left over, although he could not recall exactly how many. These included the job cards for refitting panels 666AR and 666BR. He recalled checking the Maintenance Manual panel diagrams to check the locations of these panels, before going to the wing to look for them. He inspected the wing leading and trailing edges and stood on the railings of the staging behind the wing to get a better view of the top of surface. However, he could not see any 'holes' in the wing and therefore assumed that all the panels must already have been fitted. He then proceeded to stamp the remaining job cards. Although he was aware that he had not fitted the panels himself, he had

20

concluded that they must have been fitted and, trusting his colleagues, saw no reason to doubt this. He believed that the flaps were up at the time he inspected the wing. He realised, in hindsight, that he had misinterpreted the panel diagram and had not recognised the fact that panels 666AR and 666BR are concealed by the flap drive fairings when the flaps are retracted.

When asked why he had stamped the remaining job cards without further need for checking, he replied that it was not unusual to have cards remaining after all of the panels had been installed and their job cards stamped, due to the problem of job card duplication. It is sometimes the case that if there is more than one maintenance task which requires access to a specific area, each of the tasks will have it's own associated set of job cards for removing and refitting the access panels. Thus there may be multiple sets of cards for removing and refitting the same panel(s). In this situation, it was common to 'pre-certify' or 'blind stamp' the duplicate sets and leave one set of cards open to be stamped after the panels had been removed and refitted. The fact that there were a number of job cards left over, even though all of the panels had apparently been fitted, was not unusual and so he was unperturbed by this fact.

According to anecdotal information, it was not unusual for technicians to certify for work performed by others, as it was frequently the case that technicians from other shifts would go off duty without certifying for work completed. It would then be up to the oncoming shift to verify that the maintenance tasks had been completed satisfactorily before certifying for them.

Following an earlier AAIB report on an incident involving the loss of a large panel from one of the Airline's Boeing 777 aircraft, G-VIIA on 26 June 2003 (see section 1.6.8 of this report), the Maintenance Organisation reviewed its aircraft maintenance programmes with a view to minimising the duplication of task cards. Notwithstanding this, the Maintenance Organisation believes that it is difficult to remove all duplication due to stand-alone work packages for modifications and unscheduled maintenance tasks that are additional to the normal scheduled maintenance tasks. LAE's and technicians have been made aware of this possible duplication and instructed to address this potential hazard by cross-referencing during task preparation.

1.6.7.4 Location of job card racks

The job card racks were located on the left side of the aircraft, on the Mezzanine level, some distance from the right wing. To reach the job card racks from the right wing, it was necessary to descend a set of steps to get to the lower level of the staging, ascend another set of steps to access the Mezzanine level and then cross through the front of the aircraft. Whilst it might have seemed more logical

21

to remove the job cards and take them to the work area, the removal of cards en-bloc from the racks was generally discouraged, because of concerns that the certification copies of the cards might be misplaced. A further reason for the card racks being placed on the Mezzanine floor was that the Production Controllers relied on having an oversight of the job cards to gauge the rate of progress of work on the aircraft.

Since the incident to G-CPER, the 'TBD' maintenance facility has been closed and relocated to another hangar. Prior to commencing maintenance in the new facility, the positioning of all task card racking was given careful consideration by engineering management, in conjunction with maintenance staff, to ensure that it was placed in the most effective position on and around the maintenance docking. On completion of the facility a risk assessment was carried by the Quality department to ensure that all relevant areas of the JAR-145 requirements for aircraft maintenance had been met. The results of this review, completed prior to starting maintenance, were found to be acceptable.

1.6.7.5 Environmental factors

The technician could not recall being fatigued whilst on duty, nor did he feel that that he was under any abnormal time pressure. He pointed out that the LAEs were usually very good in protecting the technicians from the perceived pressures from management. In his opinion, there were no factors relating to the physical working conditions that would have affected his ability to perform his work satisfactorily.

1.6.8 Boeing 777 G-VIIA Air Driven Unit bay access door detachment

In March 2005, the AAIB published a report on its investigation of an incident on 26 June 2003 to a B777-236B aircraft from the same Airline, in which a large access door measuring 4 x 6 feet and weighing 70 lb detached from the aircraft on departure from London Gatwick Airport. The panel caused substantial damage to two cabin windows and minor impact damage to the fuselage and fin. Large fragments of the panel landed close to persons on the ground.

The AAIB report (reference EWC/2003/06/04) concluded that the panel had not been adequately fastened and the security of the panel had not been physically verified following recent maintenance at the Airline's London Gatwick engineering base. It identified systemic deficiencies in the procedures for controlling the fitting and securing of panels following maintenance. The issues highlighted included:

22

- a lack of discipline in the certification of job cards, with individuals failing to certify for work completed before going off shift, presenting other shifts with the problem of certifying for tasks, that they had not performed themselves.

- the practice of 'batch stamping' the job cards being prevalent due to the remoteness of job card racks from where the work was being performed.

- the problem of duplicate sets of panel job cards, which contributed to the lack of discipline and control in the refitting and securing of panels.

The G-VIIA investigation findings suggest that similar maintenance practices to those in the 'TBD' Bay 13 hangar were in use at the Airline's Gatwick engineering base, and which had also resulted in a culture of 'blind stamping' of job cards and relying on assumption that others had performed the work, without verification. The G-VIIA investigation report concluded that these systemic issues and not individual carelessness, had caused the maintenance errors.

1.6.9 Engine oil servicing task

The technician and LAE who performed and certified for the servicing of the engine oils co-operated fully with the investigation.

1.6.9.1 Technician's role - engine oil servicing

The technician who performed the engine oil servicing stated that he had predominantly worked on the right wing during G-CPER's maintenance check (but he was not the individual who had certified for fitting panels 666AR/666BR). He came back on shift on Thursday 4 September 2003. On the following Saturday he, together with two other technicians, was directed by his LAE to start working through the tasks on the 'Daily Check' inspection sheets (Appendix 2). The tasks had not been specifically allocated and so they decided between themselves how they would divide up the tasks. He had volunteered to work on the engines. 'The Daily Check' items were begun on the Saturday and completed on Sunday 7 September, the day the aircraft left the hangar. The 'Daily Check' maintenance tasks are part of the Approved Maintenance Programme and must be completed once per day. The work is usually performed in an operational area (either on the Ramp or in a minor maintenance hangar). The rationale for performing the 'Daily Check' at the end of the 'Inter 4'

23

heavy maintenance, was to allow the aircraft to re-enter passenger service immediately.

On beginning this work, the engine docking was still in place and the engine cowls were open, but he believed that the aircraft may already have been lowered off the jacks. He checked the IDG, CSD and engine oils. He noted that both engine oil quantities were showing 19 litres on the oil tank sight glass. He advised his LAE, who was to perform the engine runs, that the oil levels were high and that he should bear this in mind. The aircraft was towed from the hangar to the engine run pen for the runs to be performed. Whilst this was underway, the technician assisted in clearing the docking and staging from Bay 13. When the aircraft returned, he became involved with checks of the cabin pressurisation system, which took up the rest of the day.

The next day, he went to re-check the engine oil levels, noting that both engines were now showing nearly 20 litres on the sight glass. He recalled from a Technical Newsletter, issued by the Powerplant Technical department, that overfilling the engine oils was known to cause oil smells in the cabin and that the engine oils should be filled to a maximum of one litre below the full graduation mark on the oil tank sight glass. The department had also issued Temporary Revision 12-593 to amend the Aircraft Maintenance Manual instructions for servicing the engine oils and had placarded the engine oil servicing access doors to reflect the new requirement (Figure 6). He decided that the oil quantities were excessive and proceeded to drain one litre of oil from each engine. After this the left and right engine oils were showing 18/19 litres on the EICAS display and 19/19 litres on the sight glass respectively. Satisfied that the quantities were now acceptable, he stamped the 'Daily Check' sheet tasks for the engine oils but did not record the draining of the oil in the Aircraft Technical Log, believing that the LAE would do so. In the event, the LAE did not, due to a breakdown in communication. Each had assumed that the other would record the adjustment of the oil levels in the Technical Log.

When asked whether he had consulted the Aircraft Maintenance Manual procedure for checking the engine oil levels, the technician stated that he had not. He considered it to be unnecessary, believing that he was correct in simply following the guidance in the Technical Newsletter.

24

Figure 6 B757 Engine oil service access door

1.6.9.2 Certification of engine oil servicing task

The technician who performed the engine oil servicing could not certify for the task, as he did not hold any company authorisations on the Boeing 757. This responsibility therefore fell to the LAE responsible for the engines.

The LAE concerned had been allocated to work on the external fuselage during G-CPER's maintenance check. Although he still had work to complete in this area, when he came back on shift in the final few days of the maintenance, he was also assigned to complete the outstanding work on the engines. In his opinion this was due to a shortage of LAE's and hence a lack of sufficient certification cover.

The LAE reviewed the job cards for the engine runs, which he was to perform. He did not recall seeing any job cards for checking the engine oil levels after the engine runs. There was, however, a job card to top up the oil in the left engine, which had been raised against an incoming defect in the Aircraft Technical Log for excessive oil consumption. He recalled that the engine oil levels had been satisfactory and remembered seeing the oil quantity indications on the EICAS display showing 20 litres in each engine, although he could not recall if this was before or after the engine runs. Having completed the engine runs satisfactorily, he certified the job cards and also the job card for topping up the oil in the left engine, based on the EICAS indications. The oil quantities recorded in the Technical Log at the start of the maintenance check had been 15 and 17 litres

25

for the left and right engines respectively and he believed, with hindsight, that the engine oils must have been replenished at some point during the maintenance. There was, however, no record in the Technical Log of any oil uplift.

The technician and the LAE had been assigned to crews on different parts of the aircraft. They had not worked together on G-CPER until they commenced the work on the engines. The relationship between the two was not very clearly defined in that they were not part of an organised team, but were rather loosely associated, because they both happened to be working on the engines. Furthermore, the LAE's role was a technical one, with no supervisory function in relation to the technician. There had been limited communication between the two regarding the servicing of the engine oils.

The LAE remembered seeing the technician draining oil from each engine the day after the engine runs and assumed that he had performed the oil servicing task satisfactorily. He saw no need to verify the oil levels himself and proceeded to certify the 'Daily Check' items for the engine oil servicing.

When asked whether he was familiar with the Temporary Revision 12-593 to the Aircraft Maintenance Manual instructions for servicing the engine oils, he replied that he was not and that he simply followed the instructions on the placard on the engine oil servicing access door, which state that the revised maximum fill level is one litre down from the 'FULL' graduation on the sight glass.

He stated that the hand-over from the previous shift, who had worked on the engines, had been satisfactory, although it was often the case that a previous shift would go off duty without having certified all of the job cards for the work completed. This meant that the oncoming shift had to verify that the work has been completed before certifying the job cards. One example of this was during the recent 'Inter Check' maintenance on another aircraft (G-CPES), where the task to make safe the flap and slat systems had been completed, but the job cards had not been stamped, leaving the oncoming shift the problem of certifying for completion of the task.

1.6.10 Aircraft Maintenance Manual procedure for engine oil servicing

The instructions for servicing the engine oil are contained in Chapter 12-13-01 of the 757 Aircraft Maintenance Manual. According to these instructions, the oil level may be checked either by viewing the sight glass on the oil tank, or the indication on the lower EICAS screen in the cockpit. Regardless of which

26

method is used, the oil level must be checked within ten minutes and one hour of engine shutdown.

These instructions specifically state:

'Make sure that the engine has been shut down for a minimum of ten minutes but less than one hour.

(a) If the engine has been shut down for more than one hour, operate the engine at minimum idle for five minutes (AMM 71-00-00/201) and check the oil level again.

NOTE: Over an extended time, you can see a small change in the oil level from what you saw after you filled the oil tank. This is the result of oil movement through the oil system under the effects of gravity and temperature change.'

If the engine oils are serviced more than one hour after shutdown, there is a danger of overfilling because the oil level on the sight glass may under-read, due to oil drainage past the high pressure pump carbon seal.

1.6.11 Maintenance Organisation's instructions for oil servicing

Given the history of problems of oil smells in the cabin and flight deck, the Maintenance Organisation's Powerplant Technical Department had taken various measures aimed at preventing overfilling of the engine oil.

In November 2001, a Technical News was issued for the 757 fleet, advising maintenance staff that the engine oil 'full' level had been reduced, stating:

'….the engine will be considered full when it is ONE litre down on the oil tank sight glass…'

A further Technical News was issued in February 2002 which re-iterated that the fill level was one litre down and reminded maintenance staff of the Maintenance Manual requirement to service the oil levels between 10 and 60 minutes of engine shutdown. Another, similar Technical News was issued in September 2003, following the G-CPER incident, as a further reminder.

The revised oil fill level was also visually highlighted by placarding the engine oil servicing access door (Figure 6).

27

In November 2001, Alert Temporary Revision No 12-593 was issued by the Powerplant Technical Department to amend the 757 Aircraft Maintenance Manual to reflect the new internal procedure. This was a covering document that advised of changes to the Maintenance Manual procedures prior to the Manual itself being formally amended. Under an arrangement with Boeing, the Airline's customised Maintenance Manual should have been amended at the next revision cycle, however it was noted that the Jan 28/03 Revision of the Maintenance Manual still reflected the 'full' level as being 20 litres. Further confusion may have been caused by the instructions contained in the Maintenance Organisation's '757 Ramp Servicing Manual', which had not been updated to reflect the new oil fill level and did not state that the oil level should be checked between 10 and 60 minutes of engine shut down. Both of these manuals have since been corrected.

Most recently the engine oil tanks have been modified by painting green and red bands next to the sight glass to visually differentiate between an acceptable oil level and what is considered to be overfull. The placard on the engine oil servicing door was also replaced with one stating that the maximum engine oil level is the top of the green band. The maximum fill level is now two litres below the 'FULL' graduation on the sight glass, giving a greater margin of protection against overfilling.

1.6.12 Engine oil servicing procedures on the ramp

Concerns that the Maintenance Manual procedures had not been followed when servicing the engine oils on G-CPER during the recent maintenance, prompted a review of the Maintenance Organisation's B757 oil servicing procedures in the operational areas.

For some years, the Airline has had a policy of not requiring an engineer to attend the aircraft during a turn-round, unless absolutely necessary, for example to rectify a defect. The engine oils are only checked on the sight glass and topped up if the flight crew decide that this is necessary, based on the EICAS oil quantity indications. The routine requirement to check the engine oil level is on the 'Daily Check', which is usually performed overnight on the ramp or in a minor maintenance hangar.

The AAIB, accompanied by a representative from the Airline's Safety Services Department, visited the Airline's operational maintenance area at London Heathrow Terminal 1 ('Tech 1') on the night of 6 November 2003, to observe the engine oil servicing practices.

28

An informal interview was conducted with the technician who was allocated to perform the 'Daily Checks' on the night-stopping B757 aircraft. As a Certifying Technician with Ramp Maintenance Authorisation, he was authorised to carry out the 'Daily Check' and certify for it's completion in the Aircraft Technical Log. He would typically be allocated three or four aircraft by his Shift Manager on which to perform the 'Daily Checks', which he would complete from memory. The 'Daily Check' comprises twenty tasks in total and these are listed on form 'AIR3500'. There are accompanying instruction sheets which provide more detailed instructions on how to perform specific tasks. The task to check the engine oil levels is No 14 on the list and the instruction sheet states:

'14. Check engine oil levels using sight glass (within 10 to 60 minutes of shutdown). Compare with EICAS reading…'

When asked whether he planned his work to ensure that the oil levels were checked within the specified time period, he replied that no planning was carried out in this respect. The normal procedure was to complete the 'Daily Check' on one aircraft before moving onto the next. It might be the case that the oil levels were checked within the specified time window, but it was equally likely that they might not. The normal procedure was to top up the oil level to one litre below the full mark on the sight glass, irrespective of whether the engine was hot or cold. He did not refer to the Maintenance Manual as he was so familiar with the 'Daily Check' tasks, but he recalled having read the Technical News and Alert Temporary Revision to the Maintenance Manual highlighting the revised oil fill level.

An aircraft visit was then conducted, selecting G-BPEI from the group of aircraft that had been allocated to the technician. The aircraft had arrived on stand at 2130 hrs and was visited at 2215 hrs. The Aircraft Technical Log showed that the engine oil quantities recorded on arrival by the flight crew, based on the EICAS indications, were 19 litres in the left engine and 20 litres in the right engine. At the time that the aircraft was visited, the EICAS indication showed 18 and 20 litres in the left and right engines respectively. A visual check of the oil tank sight glass showed that the left engine oil level was ½ litre below the 'FULL' mark, whilst the right engine oil level was ¾ litre above the 'FULL' mark. The right engine was therefore overfull by 1¾ litre, relative to the 19 litre revised fill level specified by the Airline. The excess oil was drained from the right engine to reduce the quantity to an acceptable level.

1.6.13 Quality Audit of engine oil servicing procedures

The findings of the 6 November visit to 'Tech 1' were highlighted to maintenance and quality management in the Airline's Maintenance

29

Organisation, with the recommendation that the oil servicing procedures should be revised to ensure consistent compliance with the 757 Aircraft Maintenance Manual instructions. It was apparent from comments made by management however, that they were sceptical that the oil smells might only have been caused by incorrect servicing of the engine oil.

The Maintenance Organisation's Engineering Quality Services (EQS) Department conducted an audit of the engine oil servicing procedures in 'Tech 1' on the night of 16 February 2004, in response to concerns raised by the CAA Heathrow Regional Office, that the Maintenance Manual requirement to check the engine oil levels between 10 and 60 minutes of engine shutdown was not being consistently complied with. The findings of this audit reflected those of the AAIB visit on 6 November 2003, in that the time requirement was not being taken into account when planning the maintenance.

Following this audit, the maintenance planning procedures were amended. These amendments included a requirement to make a certifiable entry in the Aircraft Technical Log, of the time the engines were shut down and the time the engine oils were serviced. The B757 'Daily Check' Sheets were amended to reflect the new requirement, which is subject to audit. The new requirement was publicised via a Quality Alert Bulletin and an article placed on the Quality notice board in the 'TBD' hangar. The Powerplant Technical department also carried out a series of presentations to maintenance staff to raise awareness of the issues surrounding B757 engine oil servicing. The changes in procedures produced a significant reduction in the following months in the rate of reporting of oil smells on the Airline's B757 fleet.

1.6.14 Previous history of oil smell problems

The Airline has a history of problems of oil smells in the cabin and cockpit on its Boeing 757 fleet. Previously, the problem was largely restricted to Airline's older RB211-524C powered 757s, but these aircraft have since been sold and the problem began to manifest itself on the RB211-535E4 powered aircraft, which due to design differences in the engine, should be less susceptible contamination of the cabin air supply by engine oil.

In January 2004, the AAIB published Formal Report 1/2004, which presented the findings and conclusions of it's investigation into the general problem of contamination of cockpit and cabin air supplies by turbine oil fumes. A review of the UK CAA Mandatory Occurrence Report database during that investigation showed that the Boeing 757 experienced a high rate of reporting of oil smell issues. It was also noted that the majority of these events had been reported by one UK airline; the operator of G-CPER.

30

In the course of the investigation, the AAIB issued Safety Recommendation 2001-5 in May 2001, recommending that:

'….the Federal Aviation Administration, as the Primary Certification Authority for the Boeing 757 type, takes early action in conjunction with Boeing to require that operators of this type should ensure that the standards of maintenance and modification of the aircraft's air conditioning system, engines and APU are such that air supply contamination by oil from the engines and/or APU, or by any other potentially hazardous substance, is avoided.'

In response to this safety recommendation, working teams at Boeing and Roll-Royce conducted investigations into the Boeing 757 oil smells issue. The key findings of the teams were as follows:

'the root cause of flight deck odor problem is oil leakage from the Rolls-Royce RB211-535C engine. The Auxiliary Power Unit (APU) although a contributor to some flight deck odor events, has been found to be a negligible contributor to the flight deck odor issue for the RB211-535C powered 757-200…'

'Roll-Royce identified specific overhaul improvements for the engine. Rolls-Royce did not identify any specific design changes that would further reduce oil leakage. While these improvements have not been 100% successful in eliminating leakage, they are consistent with the best practices used on all Rolls-Royce engines and have been incorporated into the appropriate engine shop manuals…'

'…Another outcome of the investigation by the team was the recognition that over-servicing of oil for the RB211-535C engines contributes to the flight deck odor issue. (The operator) has instituted emphasis and corrective measures to eliminate oil over-servicing as a contributor to the flight deck odor problem. Boeing has updated the oil servicing procedure in the 757 aircraft maintenance manual…'

During the course of that investigation, the AAIB communicated with the Maintenance Organisation's Powerplant Technical department, that had been actively involved in addressing the issue. As highlighted above, this included the issuing of technical communications and procedural amendments to emphasize to maintenance staff the importance of servicing the engine oil in accordance with the Aircraft Maintenance Manual instructions. It appeared however, that the Maintenance Organisation's maintenance planning procedure did not take into account the time restrictions for checking the engine oils.

31

1.6.15 Other recent Boeing 757 oil smell incidents

In monthly Bulletin 12/2004, the AAIB reported on an incident on 19 November 2004 to aircraft G-CPES, operated by this Airline, in which a strong smell of scorched oil became apparent in the cockpit on rotation. The crew declared a 'PAN' to air traffic control and donned oxygen masks in accordance with the emergency procedure. The aircraft returned to London Heathrow, where it landed uneventfully. Despite extensive troubleshooting, no defects were found that could have produced the oil smell in the cockpit. However the engine oil quantities were found to be above the operator's specified maximum limit.

Two further reports of oil smells in the cockpit on G-BPEE, also operated by the this airline, were reported to the AAIB. These incidents, on 12 November 2004 and 16 November 2004, are subject to separate AAIB investigations.

1.7 Meteorological information

The actual weather conditions at Gatwick following the diversion as reported by the crew were: dry, with 50 km visibility, wind 190°/10 kt and temperature +17°C.

1.8 Aids to navigation

1.8.1 Instrument Landing System (ILS), London Gatwick Runway 26L

The ILS for Runway 26L at Gatwick radiates 'I-WW' on 110.9 MHz. The localiser is aligned with the final approach track for Runway 26L on a track of 260°M. The associated glideslope signals, radiated on a frequency-paired channel give a glide path angle of 3°. The system was fully serviceable at the time of the incident.

1.9 Communications

A complete set of Radio Transmission (RT) recordings, were studied, in order to follow the progress of the flight and the approach into London Gatwick.

The radio callsign used by the crew was Speedbird 324 and the initial report of 'fumes on the flight deck', was made to London Area Control Centre (LACC) on 135.325 MHz where radar heading, descent to FL120 instructions and transponder code 7700 allocation were given.

London Terminal Control Centre (LTCC) on 134.125 MHz continued descent clearance to FL80 and radar heading for an approach to London Gatwick.

32

The Gatwick Director on 129.025 MHz managed the radar headings for the aircraft to intercept the ILS for Runway 26L and cleared the aircraft to an altitude of 2,000 feet with further descent with the ILS. The flight crew were cleared to land and offered the options of remaining on 129.025 MHz or changing to the Tower frequency on 124.225 MHz. The commander elected to change to the Tower.

London Gatwick Tower cleared the aircraft to land and was made aware by the aircraft commander of the 'flight control difficulties', being encountered. The Tower provided surface wind checks during the final stages of the approach and co-ordinated the movement of the Airport Rescue and Fire Fighting Services (RFFS).

Following the landing the Tower advised the pilot that the tyres were smoking and instructed the pilot to change to the RFFS frequency of 121.6 MHz.

The flight crew wore oxygen masks for most of the flight. Both commented on the difficulty in hearing due to the mask amplifying the sound of their breathing. This caused difficulties in communication between the two pilots and ATC.

1.10 Aerodrome information

London Gatwick Airport has two hard-surfaced parallel runways:

08R/26L Asphalt/Concrete 3,316 metres long, 46 metres wide 08L/26R Asphalt/Concrete 2,565 metres long, 45 metres wide

The landing runway was 26L, which was fully equipped to provide the autoland guidance for the aircraft. The Landing Distance Available (LDA) was 2,831 metres with a threshold elevation of 195 feet and an airport elevation of 196 feet. The runway was equipped with standard High Intensity Runway Lighting (HIRL), Centreline Lighting (CL) spaced at 15 metre intervals, Touch Down Zone (TDZ) lighting and a Calvert, three bar, High Intensity Approach Lighting System (HIALS) suitable for CAT 111 operations. The Precision Approach Path Indicator (PAPI) system was set to 3° and all the facilities were fully serviceable.

The final approach to Runway 26L is made over open countryside with aircraft passing over an airport road and car park located on the eastern airport boundary.

33

1.11 Flight recorders

1.11.1 FDR/CVR description

Cockpit Voice Recorder

The aircraft was fitted with a magnetic tape Cockpit Voice Recorder (CVR) which recorded the last 30 minutes of flight crew speech and cockpit area microphone sounds. Unfortunately, the CVR circuit breaker was not pulled after the landing, and so the CVR recording contained only post-landing cockpit sounds and crew speech; the sounds from the flight having been overwritten.

Flight Data Recorder

The aircraft was fitted with a magnetic tape Universal Flight Data Recorder (UFDR) which recorded a large number of flight data parameters and discretes on a continuous 25-hour loop. These included relevant air data, engine, control surface and cockpit controls, as well as a number of discretes related to smoke or fire in areas of the aircraft and engines. All of the available flight data was recovered successfully.

1.11.2 Relevant UFDR Information

There were no parameters on the UFDR which would provide indications of smells or fumes in the cockpit and/or cabin without smoke or fire present. In addition, none of the UFDR discrete parameters related to smoke or fire was activated at any time during the incident.

The UFDR data show that full and free checks of the flight controls were carried out prior to takeoff. Full deflection of the control wheel was measured on the UFDR as +/- 85°. Full deflection of the ailerons (+/- 21°) occurred at +/- 55° of control wheel deflection, the remaining 30° of control wheel angle causing the roll spoilers to deploy for further roll control. From aircraft handling considerations, the available parameters on the UFDR indicated that the start-up, taxi, takeoff, departure from Heathrow, climb and descent appeared normal; there did not appear to be any control problems until the final stages of flap were selected prior to carrying out the landing at Gatwick.

A time history of the relevant flight parameters during the approach to Gatwick is shown in Figure 7. This shows that the approach was normal until the final stages of flap were lowered. When 25° and 30° of flap were selected the autopilot applied about 12° and 20º of left control wheel respectively. The latter control input was insufficient to stop a slight bank angle of approximately 4° to

34

the right from developing. The autopilot was disconnected 29 seconds later at an airspeed of about 130 kt, and remained off for the remainder of the approach and landing. The aircraft heading deviated to the right by about 5°, and the aircraft diverged to the right of the localiser centreline by about 0.7 dots. It can also be seen that a small left rudder input was made for about 4 seconds. Thereafter, the aircraft was controlled manually in roll by the use of the lateral controls alone until touchdown. To maintain wings level flight, once the flaps were lowered to the 30° setting, an average of about 20° of control wheel to the left was required, with peak-to-peak control inputs approaching 0° to 35° (ie just under half of the available control wheel authority to the left) equivalent to ¾ of the available aileron authority to the left.

1.12 Wreckage and impact information

Not applicable.

1.13 Medical and pathological information

Not applicable.

1.14 Fire

There was no fire.

1.15 Survival aspects

Not applicable.

1.16 Tests and research

Not applicable.

35

Figure 7 Relevant Flight Recorder Parameters for Approach and Landing

at London Gatwick

36

1.17 Organisational and management information

1.17.1 The Airline's Safety Management System

Joint Airworthiness Requirement (JAR) Ops Part 1 prescribes requirements applicable to the operation of any civil aeroplane for the purpose of commercial air transportation. JAR-OPS 1.035 specifies the requirements for an operator's Quality System. JAR-OPS 1.037 requires that the operator has in place an accident prevention and flight safety programme. The intent of JAR-OPS Part 1 is that an airline shall have a well-defined safety management structure, with clear accountability for safety. It defines the 'Accountable Manager' as being the individual ultimately responsible for safety in the airline. In a large airline, the Accountable Manager will necessarily delegate the day to day management of safety to the heads of the various branches of the airline (referred to in JAR-OPS as 'Nominated Post Holders'), however he may not delegate his overall responsibility for safety.

The purpose and objectives of the Airline's Safety Management System are explicitly defined in its Safety and Quality Policy Manual. Section 9 of the manual states:

'The implementation of a Safety Management System is intended to enhance safety and quality performance by promoting best practice and moving beyond mere compliance with legislative and regulatory compliance. The Safety Management System is both proactive and reactive, providing a means to anticipate and prevent or reduce the effects of risks.'

The reporting structure of the Airline's Safety Management System pertaining to engineering and operational activities is shown in Figure 8. The scope of the system encompasses all aspects of the Airline's operations, including cargo, ground handling, engineering and flight operations. Each area has its own Safety and Quality department, responsible for setting standards and monitoring compliance through auditing and investigating safety incidents. They are responsible for logging safety occurrence reports onto the Airline's electronic safety database, (known as 'eBASIS') and allocating the incident to the relevant section to investigate and take suitable corrective action.

Each branch of the Airline holds regular Safety Board meetings, so that the Accountable Manager for safety (in this case the Airline's Chief Executive Officer) can satisfy himself that company procedures and applicable regulations are being complied with and that safety issues are being addressed in a timely and effective manner.

37

Figure 8 The Airline's Safety Management Reporting Structure

(Operations and Engineering only shown)

The next higher level of reporting includes the Accountable Manager's Meeting, the purpose of which is 'to provide the Accountable Manager with an executive forum for discharging his key responsibilities in accordance with legal, regulatory and company requirements' as required under JAR-OPS 1.035 and the Board Safety Review Committee (BSRC), which is a corporate requirement and has the broader remit: 'To review all significant matters of safety and security across the airline to ensure that effective preventative and/or remedial action is taken.'

The dual reporting line upwards depicts the fact that the Safety Boards report to the BSRC on performance and actions taken, and to the AMM for executive decision making and for cross-department issue resolution. The AMM is chaired by the Chief Executive of the Airline and attended by the Nominated Post-Holders from the various branches of the Airline, whilst the BSRC is chaired by a Non-Executive Director and attended by Executive and Non-Executive Directors of the Airline.

Board

Ground Safety Board

Engineering Safety Board

Flight Safety Board

Accountable Managers Meeting

Board Safety Review Committee

Cargo Safety Board

Quality Managers Meeting

38

1.17.1.1 Tracking of safety issues

The Airline's 'eBASIS' safety reporting database is network-based so that it can be widely accessed throughout the Airline. The details of safety reports are booked onto the system by designated 'eBASIS' co-ordinators within the various safety and quality departments across the Airline. Each report is assigned a unique tracking number and allocated to the appropriate department to investigate and take corrective action if necessary. As the investigation progresses, the findings and actions taken are recorded on the database, to create a narrative of the history of the safety issue and the progress made in addressing it. The issue may be formally closed by the responsible department, or the coordinator. Any safety recommendations issued in the course of an investigation are also entered into and tracked via 'eBASIS'.

The safety recommendations issued by the Safety Services department during their investigation of the G-CPER incident were recorded on 'eBASIS', however as of January 2005, they had not yet been responded to by the Maintenance Organisation, which had taken independent action in response to its own Quality Investigation findings. These actions taken had not been entered on 'eBASIS'. The Maintenance Organisation has since fully responded and all actions are now closed in 'e-BASIS'.

1.17.1.2 Independent safety oversight

The Airline's Safety Services department plays a key role in providing an independent safety overview of the Airline's activities. The Manager of Safety Services reports directly to the Director of Safety and Security. The primary activities of the department include monitoring the actions taken in response to air safety incidents across the airline via the 'eBASIS' system, performing trend analyses and risk assessments and preparing the papers for the Board Safety Review Committee. Air Safety Investigators from the department are empowered to conduct independent investigations into more serious safety incidents, in accordance with the Airline's 'BASI 4' procedure. These investigations may lead to the issuing of safety recommendations for corrective actions intended to prevent similar incidents in the future. If the actions taken in response to a safety issue are not considered to be appropriate, Safety Services can re-open the incident in 'eBASIS' for further action, or in more serious cases, it can elevate the issue for review at the Accountable Managers Meeting or the Board Safety Review Committee. Whilst the department has no executive authority to implement safety recommendations, it does have the power to enforce them directly through the Chief Executive Officer.

39

It became apparent during the course of the AAIB's investigation, that the management of quality in the Airline had been largely devolved to the various sections with a limited degree of central control over quality and safety standards; each area defining how it conducted it's own quality activities. This was particularly apparent in the Airline's relationship with its Maintenance Organisation.

Since the G-CPER incident, the Safety Services department has been expanded to become Corporate Safety and Quality, which includes the previous Safety Services responsibilities and a new section, Corporate Quality. The remit of the Corporate Quality section includes conducting safety and quality reviews of key operational departments within the Airline. These reviews commenced following the publication of the airline's Operational Safety and Quality Management Manual in June 2004. The first such review of the Maintenance Quality system was completed in April 2005.

The Safety Services department had generally regarded itself as having good working relationships with most sections of the airline. However, in discussions with the Safety Services management, the AAIB gained the impression that they had a limited ability to influence the actions of the Maintenance Organisation on matters of safety, given that organisation's degree of autonomy.

Following the G-CPER incident, the Airline reviewed the relationship between Safety Services department and the Maintenance Organisation. Although the Head of Safety (now Head of Corporate Safety and Quality) attended the Engineering Safety Board on a regular basis, it was established that the relationship between the two departments required some focus and communications needed to be improved. The following changes were introduced as a result:

- The Head of Corporate Safety and Quality (CS & Q) now attends both the Technical Safety Group and Maintenance Safety Group meetings on a monthly basis.

- Air Safety Investigators (CS & Q) have an open invitation to attend the Engineering Quality forums.

- The Board Safety Review Committee was made formally aware at the May 2005 board meeting, that the Head of CS & Q and General Manager Engineering Services, have informal and formal (if required) communication channels to debate issues.

40

- The BSRC was made formally aware at the June 2005 board meeting, that CS & Q now have a formal agenda item on the Maintenance Safety Group where any concerns can be raised at an early stage.

- Incidents and items that may be worthy of bringing to the Board's attention are openly discussed prior to the meeting.

- Corporate Safety and Engineering Quality have further developed a working relationship to ensure that they work together on investigations, producing one report with agreed actions. A structure has been put in place to ensure that safety recommendations are debated and either incorporated in full, or by means of an alternative acceptable means of compliance. Corporate Safety and representatives from the Maintenance Organisation will attend safety meetings with accident investigation authorities as a team, rather than independently as in the past.

1.17.1.3 Implementation of safety recommendations

The Airline's Operational Safety and Quality Management Manual (Issue 1) describes how safety recommendations issued in the course of investigations should be tracked and implemented. It specifically states:

'Recommendations are tracked through eBASIS, the relevant Safety Board(s) and, for significant incidents or accidents, reviewed through the Board Safety Review Committee (BSRC) to ensure that appropriate action has been taken to prevent recurrence. The BSRC will confirm when a significant investigation has been satisfactorily concluded.'

The G-CPER incident was kept as an open item on the BSRC agenda, pending the outcome of the AAIB investigation.

1.17.2 Requirements pertaining to aircraft maintenance

The Airline has its own JAR-145 approved Maintenance Organisation, which provides line and heavy maintenance support at designated stations and bases.

The complexity of large transport aircraft demands that strictly controlled procedures are followed to ensure that the aircraft is maintained in an airworthy and hence safe, condition. Each individual maintenance task must be completed to a suitable standard so as to ensure that the overall airworthiness of the aircraft

41

is assured. It is on the strength of this principle that the final Certificate of Release to Service (CRS) may be issued following maintenance. One of the requirements for ensuring that the maintenance is performed correctly is the need to comply with approved maintenance instructions, such as the aircraft manufacturer's maintenance manual for the aircraft.

JAR 145.45 (Amendment 5, dated 1 January 2003) appertaining to 'Maintenance Data', states:

'(a) The JAR-145 approved maintenance organisation must hold and use applicable current maintenance data in the performance of maintenance...'

It further states:

'(b) For the purposes of JAR-145 applicable maintenance data is:

(3) Any applicable data, such as, but not limited to, maintenance and repair manuals, issued by an organisation under the approval of the JAA full member Authority including type certificate and supplementary type certificate holders…'

This also reflected in the Maintenance Organisation's procedure QS10 on 'Maintenance Certification'. Section 2.5 of this procedure states specifically:

'All work tasks performed shall be completed in accordance with authorised documentation…'

'Authorised documentation' is defined within this procedure as including the Aircraft Maintenance Manual and any applicable Temporary Revisions to it.

1.17.3 Certification of maintenance

The universal method, adopted by the aircraft operating industry, of showing that jobs, or parts of jobs, have been satisfactorily completed is for an approved person to sign and/or stamp against a declaration on a card or sheet that it has been done. It is this mark which is used as proof that a job has been done when it is no longer visible and the collection of all such declarations, related to one aircraft, are considered proof of its state of repair. A complete set of signed/stamped job cards is required to show that a maintenance input is complete and an aircraft is fit to fly.

42

In certifying for a maintenance task by stamping a work sheet or job card, the person is signifying that they have performed the work to an acceptable standard of airworthiness and must by definition, have performed the work in accordance the Aircraft Maintenance Manual, or other such approved documentation. It is only permissible to deviate from approved documentation after obtaining approval from a higher authority, such as the aircraft manufacturer.

The Maintenance Organisation's standards for the completion of maintenance are set out in procedure QS10:

'2.1 Each person completing and certifying any work activity is therefore accountable by legislation for the adequacy of tasks performed against defined standards…'

2.2 In signing/stamping for any work completed to an airworthiness standard, an approved/authorised person contributes to the issue of a CRS by another authorised person. Similarly, an individual or implied CRS completed by authorised persons contribute to the issue of a 'Final Release CRS' by another authorised person.'

1.17.4 JAR-145 Quality System requirements

Having set out the standards to which the maintenance must be performed, JAR-145 also specifies the requirements for the management of safety and quality to ensure that acceptable standards are maintained in the longer term. These are contained within JAR 145.65, which demands that:

'(b) The JAR-145 approved maintenance organisation must establish procedures … …to ensure good maintenance practices and compliance with all relevant requirements in this JAR-145…'

and,

'(c) The JAR-145 approved maintenance organisation must establish a quality system that includes;

(1) Independent audits in order to monitor compliance with the required aircraft/aircraft component standards and adequacy of the procedures to ensure that such procedures invoke good maintenance practices and airworthy aircraft/aircraft components.'

43

In addition, JAR 145.60 requires a maintenance organisation to have an occurrence reporting system for the reporting of deficiencies in the condition of aircraft or their components, or in procedures, so that conditions potentially hazardous to the aircraft are identified and timely corrective action may be taken.

1.17.5 Philosophy of Quality Assurance

Some years ago, the Airline's Maintenance Organisation, in common with many others, moved from a system of Quality Control, to one of Quality Assurance (QA). The two concepts are fundamentally different in their approach.

A traditional Quality Control system required specialist inspectors whose function was to physically check and certify that all steps of maintenance tasks had been correctly executed in accordance with approved instructions. When strictly applied, this meant that the work had to stop for an independent inspection to be performed prior to any activity that would preclude subsequent access for inspection of the work completed thus far, or when the next stage was critically dependent on the previous one being correct, until an inspector had certified it.

One of the key differences with the concept of Quality Assurance is the shift from independent checks of the work performed, to individuals having responsibility for the quality of their own work. As a result, the airline maintenance industry has generally adopted the process of self-certification for certain types of task which are deemed as non-critical to airworthiness and are therefore not considered to require a duplicate inspection. In this case, the person performing the task stamps a job card to signify that he/she has completed the task and then further stamps the card to certify that the work has been completed to the appropriate standards of airworthiness.

The foundations of a successful Quality Assurance Programme (QAP) are comprehensive working procedures which are fully adopted by staff who are appropriately trained and qualified. It places greater responsibility on the individual for ensuring that tasks are performed to the required standard.

1.17.6 Implementation of Quality Assurance in the Maintenance Organisation

Just as JAR-OPS 1 specifies the Quality System requirements for the airline operator, JAR-145 specifies the Quality System requirements for the maintenance provider. The Maintenance Organisation's Quality System is described in Part 3 of its JAR-145 Maintenance Management Exposition/Maintenance Organisation Exposition.

44

The overall management of the engineering QAP is the responsibility of the Engineering Quality Services (EQS) department. The monitoring of quality within the Maintenance Organisation is achieved through the following activities:

Compliance Audits

These are conducted on the various areas of the Maintenance Organisation to a pre-defined annual schedule. Quality Engineers from the EQS department perform these audits, the purpose of which is to verify that the organisation is in compliance with the applicable requirements (for example the JAR-145 requirements for Maintenance Organisations and JAR-OPS Sub-Part M). Compliance is typically verified by sampling the outputs of various processes, for example sampling of job task cards to ensure that they have been completed by individuals with the correct authorisations and that independent, duplicate inspections have been performed where required. The audits tend to examine the outputs of the various activities, rather than monitoring how the tasks were performed. In the past a complete JAR-145 compliance audit was performed on each of the three 'Fleet Streams' (these being the Heathrow based short-haul and long-haul fleets (Fleets 1 and 2) and the Gatwick based fleet (Fleet 3)). Latterly, the audit programme had been amended to reduce the level of auditing required by performing one JAR-145 compliance audit across all three Fleet Streams.

Task Audits

These are audits performed by Quality Engineers, which focus on a particular area or activity and they are usually conducted in response to a Non-Conformance, or where there is a particular reason to examine a process in greater detail. The audit performed of the servicing of Boeing 757 engine oils on the 'Daily Check' on 16 February 2004 is an example of this type of audit.

Product Samples

An integral part of the QAP is the Product Sampling process. Each work area is required to perform quarterly audits of their activities to a programme and schedule which are approved and monitored by the EQS department.

45

Ground Found Occurrence Reports (GFORs)

The JAR 145.60 requirement for occurrence reporting is achieved through the GFOR system. The system requires that maintenance staff report significant issues with the aircraft, its' components or the engineering procedures, that might compromise safety if not addressed.

The originator of the report records the details of the issue on a proforma, which is sent to the EQS department, who log the information onto the GFOR database on the 'eBASIS' system and assign it with a unique reference number. Each GFOR is assigned to a Quality Engineer (or 'Co-ordinator'), who is responsible for allocating it to the relevant area for corrective action to be taken, for monitoring the progress of the GFOR and for closing the GFOR, once appropriate action has been taken. The department taking the corrective action is required to provide updates on progress and details of the final action taken, by entering the information electronically against the record for the GFOR. In addition to monitoring the progress of a GFOR, the database allows adverse trends to be identified and timely preventative action to be taken.

A review of the previous three years data on GFORs raised in 'TBD' Hangar Bay 13 did not identify any concerned with the installation of panels or the servicing of the B757 engine oils.

1.17.7 Non-Conformances

A failure to comply with the applicable procedures or requirements constitutes a Non-Conformance (NC). Non-Conformances may be identified during compliance or task audits, or in the course of conducting a Quality Investigation. If it has been established that a requirement has not been met, a record is made and an NC is recorded, which requires appropriate corrective action to be taken by the Senior Manager of the department concerned, usually within one month of them being presented with the NC. NC's are monitored in the monthly Quality Forum meetings. The proposed corrective actions are also reviewed at the General Managers' weekly Safety Meeting and if it is agreed that the corrective action taken is acceptable, the issue is closed off.

1.17.8 Engineering Quality Services Department

The organisational structure of the branch of the EQS department responsible for oversight of the hangar and ramp area engineering activities is shown in Figure 9.

46

Figure 9 Engineering Quality Services structure - Engineering Operations Branch

As a short-haul aircraft, G-CPER was the responsibility of the Fleet 1 Quality Team. The number of EQS department staff in Fleet 1 totalled 4, including the Team Leader. These staff were responsible for the monitoring of engineering quality standards for a fleet of around 100 aircraft, including Boeing 757, 767 and Airbus A319/320/321 types.

The main responsibilities of the Quality Engineers included:

- daily allocation and monitoring of GFORs

- management of the aircraft Certificate of Airworthiness renewal programme for their responsible aircraft fleets

- conducting JAR compliance and task audits in maintenance hangars and operational areas

- providing Quality Department support to operational areas, hangars, workshops and stores

- issuing of temporary authorisations to maintenance staff

- investigations and reporting of quality lapses

- provision of training on quality matters

- attending monthly Fleet Quality Forum meetings

- managing various high level projects

General Manager Engineering Quality Services

Manager Quality Engineering Operations

Fleet 1 Team Leader (LHR Short-Haul Fleet)

Fleet 2 Team Leader (LHR Long-Haul Fleet)

Fleet 3 Team Leader (LGW Fleet)

3 x Quality Engineers 3 x Quality Engineers 3 x Quality Engineers

47

The geographical separation of the areas covered by the Fleet 1 Quality Engineers was considerable. They ranged from the Ramp areas on the airport itself, to the minor and heavy maintenance activities spread over the Airline's East and West maintenance bases at Heathrow. All of the Quality Engineers were co-located in the same building at the East Base engineering site. There has been a deliberate reduction in the number of staff in the EQS organisation over the past few years, as it was considered to be overstaffed.

1.17.9 Quality department (EQS) oversight of maintenance activities

In seeking to establish the degree of quality oversight in the hangars in Technical Block D, the AAIB conducted informal interviews with staff in the hangar, including Shift Managers, LAE's and technicians. They consistently reported that they seldom observed a Quality Engineer in the hangar and that visits by 'Quality' tended to be brief, with very limited interaction with the staff on the hangar floor. A number of individuals were of the opinion that whilst the EQS department was not often able to tackle the fundamental issues that were detrimental to engineering performance, it was quick to highlight quality lapses or Non-Conformances.

The Quality Engineer responsible for the 'TBD' Hangar Bay 13 was also interviewed by the AAIB. It was apparent that, despite best efforts, the workload and breadth of responsibilities of the individual left little opportunity for spending time in the hangar floor environment to observe the day to day working practices. A trial had been conducted in the summer of 2003, in which the Quality Engineers spent a day in the hangar, meeting various shifts and talking to staff, however, this had since lapsed with the pressure of other work and the average time spent in the 'TBD' hangar had reduced to an estimated ½ day per month.

Following this incident, the EQS department now conducts maintenance task audits and this results in approximately 30% of the departments time being devoted to oversight activities. In addition, further staff are being recruited to increase manpower.

1.17.10 The Airline's internal safety investigations

1.17.10.1 Background

It is clear from the 'British Airways Standing Instruction No 4 - Reporting of Safety Incidents' procedure that the Airline's safety investigations will be conducted by or under the authority of the Head of Safety, with individuals from the Maintenance Organisation being co-opted onto the investigation team as

48

required. However at the time of the incident it was not clear where the Engineering Quality Investigation sat in this procedure. This lack of clarity resulted in two independent investigations being conducted on the G-CPER incident, one by the Safety Services Department and the other by the EQS Department of the Maintenance Organisation.

The 'BASI 4' investigation identified deficiencies in the methods of controlling access panels and the engine oil servicing procedures. The investigation interim report included safety recommendations intended to address these systemic issues. (Such an investigation is normally required to be completed within 21 days, unless extenuating circumstances exist. In this case the interim report stated that the final 'BASI 4' report would be issued after the AAIB investigation report had been published).

The Airline has reviewed its internal safety investigation procedures and has made the following changes:

- Recent actions have been taken to ensure that all reports have a standardised structure.

- The problem of duplication of investigations has been clarified procedurally and in future only one investigation will be performed should a corporate investigation be required.

1.17.10.2 EQS Quality Investigation findings

The Quality Investigation Report identified shortcomings in the performance of the technicians and a lack of oversight by the LAE's that were involved in the incident. It also highlighted significant contributory systemic issues such as:-

'- There was no systematic method of task control for re-panelling the right-hand wing,

- The discipline for progressive certification as work progressed was not evident,

- The LAE in handing out a 'wad' of job cards to his team of technicians for certification, leaving team members to possibly stamp for work not done by them, implied that the control of work was not as robust as expected.'

Although the report identified these systemic issues, it did not identify how these practices had evolved.

49

Several Non-Conformances with approved procedures and instructions were identified within the report and these were addressed to the responsible Senior Managers in the Maintenance Organisation for action.

1.17.10.3 Corrective actions taken by the Maintenance Organisation

The maintenance management responded to the issues of the poor discipline in ensuring progressive certification of the job cards and the lack of oversight of the LAE's of work in progress by delivering a safety awareness presentation to the LAE's and Shift Managers in the operational and heavy maintenance areas. This highlighted the dangers of blind stamping job cards, failing to record work carried out, going off shift without certifying for work completed, poor handovers between shifts and poor inspection and maintenance standards.

A further presentation was given to maintenance staff to increase their awareness of engine oil servicing requirements.

A new job card was raised to check the storage racks in the hangar to remove unserviceable components prior to the aircraft departing the hangar following maintenance.

A new job card was raised to introduce a revised procedure for servicing the engine oils during heavy maintenance, to ensure that the Maintenance Manual requirements could be accomplished in a logical and practical manner.

Finally, Employment Guide proceedings were taken out that culminated in the technician who certified for installing the flap panels being disciplined.

These actions were reviewed and signed off as being acceptable at the Maintenance Organisation's weekly General Managers Safety Meeting, however it did not appear that this information had been widely promulgated outside the organisation. The safety recommendations issued by the Safety Services department remained open with no response from the Maintenance Organisation.

1.17.11 Principles of Maintenance Error Investigation (MEI)

The Airline's Maintenance Organisation has in place a procedure (TP-Q-1.2) for investigating maintenance errors. The objective of this procedure is 'to provide a formal, consistent and confidential approach to discover the underlying reasons for a maintenance error incident.' It is intended to provide a consistent method to help reduce organisational and individual errors by giving engineers and managers a tool to understand and address the factors contributing to the error.

50

The Maintenance Organisation's MEI procedure is heavily based on the Boeing MEDA (Maintenance Error Decision Aid) tool, which provides a technique for assessing whether factors such as the aircraft design, communications, working environment, maintenance data, leadership, and organisational issues, amongst others, could have been contributory to the maintenance error. The aim of the process is to make improvements to the organisation and its procedures based on lessons learnt and it relies on an open reporting culture in order to achieve this.

The UK CAA provides guidance on Maintenance Error Management in Airworthiness Notice (AN) No 71, which reinforces these principles, stating:

'The aim of the scheme is to identify the factors contributing to incidents, and to make the system resistant to similar errors.'

Such a system is not intended to provide immunity to individuals who have been willfully negligent, or displayed a disregard to safety. AN 71 provides further advice in this respect:

'4.1.1 Where an occurrence reported via MEMS indicates an unpremeditated or inadvertent lapse by an employee, as described below, the CAA would expect an employer to act reasonably, agreeing that free and full reporting is the primary aim in order to establish why the event happened by studying the contributory factors that led to the incident, and that every effort should be made to avoid action that may inhibit reporting.'

1.17.12 G-CPER Maintenance Error Investigation

As part of its Quality Investigation, the EQS department conducted an MEI investigation. Although the Quality Investigation Report had identified several systemic issues contributory to the incident, maintenance management concluded that the technician who certified for fitting flap panels 666AR/BR was culpable for the error, by knowingly certifying for work that he had not performed himself, and thus exceeding the limits of his company authorisation. This resulted in the technician being disciplined by his Senior Manager. The technician and LAE involved in the servicing of the engine oils were not disciplined, although they had also exceeded the limits of their authorisations by not following the Maintenance Manual instructions. As written records of the MEI review on the G-CPER incident were not available, the management's rationale for arriving at these decisions could not be reviewed.

The AAIB consulted technicians and LAEs from a randomly-selected shift in the TBD hangar for their views on the MEI process. The general consensus in

51

this group was that the disciplinary action had been counterproductive and gave out the wrong message. In their opinion it was detrimental to an open reporting culture and was likely to reduce the level of reporting of errors. There was a strong view expressed by certain individuals on a Continuation Training course attended by the AAIB, that the MEI process was a punitive one.

The AAIB gained the impression that maintenance staff felt that the Quality Investigation and MEI process were too closely linked with the disciplinary process.

1.17.13 The Management perspective

Managers from the Airline's Safety Services department and the Maintenance Organisation were consulted independently for their views on the events that led to the G-CPER incident.

As reflected by their investigation report and the safety recommendations issued, the Airline's Safety Services department was concerned with the systemic issues that had contributed to the maintenance errors. The department's view was that the G-CPER incident was indicative of a wider issue of the lack of robust procedures for the control of the fitting and closure of access panels. They also believed that the instructions for engine oil servicing on the Ramp and in heavy maintenance did not take into account the maintenance environment and thus the instructions were predominantly unachievable.

Notwithstanding the findings of the Quality Investigation Report, which also identified contributory systemic issues, management in the Maintenance Organisation took a different view, being more concerned with the fact that the individuals concerned had firstly committed such basic errors and secondly had deviated from approved procedures. One manager expressed the opinion that human factors issues were too often used as an 'excuse' for individuals failing to follow procedures.

Whilst presenting this view on the one hand, in an interview with the AAIB, the maintenance management also stated that they were aware that engineers and technicians, in reality, often deviated from approved procedures and accepted that this was necessary in the 'real world' if aircraft were to be delivered from maintenance on time.

The Safety Services department management expressed that they were concerned that they appeared to have a limited ability to influence the opinions of the maintenance management in their approach to dealing with human factors

52

and systemic issues within engineering. The AAIB gained the impression that relations between the two organisations could be difficult at times and that this had affected the level of communication between the two.

1.17.14 Technical training

The Airline's Maintenance Organisation has its own JAR-147 approved training department which provides training on company procedures, aircraft type-specific technical courses and hands-on aircraft engineering skills.

Candidates for technicians are trained to perform specific roles, with a much more limited scope of authority than an LAE. Their training and approvals are managed entirely within the company, but within the framework of JAR-145 requirements.

After joining the company, a candidate for technician will typically undertake a 14 week aircraft skills course, including a mixture of theoretical and hands-on training, with progress being measured through regular assessments. After passing the course, the technicians must work under the supervision of an LAE, who monitors their performance and signs the technician's Personal Experience Record book. The period of supervision is about six months, after which, if considered suitable, the technician is encouraged to apply for his Category 'A' licence standard company authorisations (either Ramp or Base Maintenance Authorisation, RMA or BMA).

To gain a company authorisation to perform ramp or base maintenance, further training is required. This comprises a three-day training course on company procedures, followed by three weeks training tailored to their specific role; for example a technician applying for RMA would receive training on basic servicing tasks, wheel changes and how to complete the Aircraft Technical Log. BMA training includes specific training on the job card system.

To gain a licence, LAEs are required to undertake extensive training to a JAR-66 syllabus, with written and oral examinations that are independently assessed by the UK CAA on behalf of the JAA, or latterly EASA, who issue the basic qualification, the 'Licence without Type Rating'. The licence is held by the individual and not the company and indicates a level of knowledge required to correctly complete the maintenance function using approved procedures. Subsequent to obtaining the basic licence, the LAE will undergo aircraft 'type training' within their JAR-145 Maintenance Organisation and on successful completion will be granted certification privileges by the company on the specific aircraft types. The CRS authorisations held allow the LAE to sign off work and release the relevant aircraft types to service. Typically an LAE will

53

have detailed knowledge beyond the required minimum standard and will have acquired through experience, knowledge of known problems with aircraft and how to rectify them.

There is no requirement or guarantee an LAE, or a technician will have any knowledge and/or experience to equip him or her to deviate from approved procedures in a safe manner and they are required to seek approval from a higher authority, (such as the appropriate Technical Department in the organisation, or the manufacturer) if it proves necessary to deviate from these procedures.

In addition to the initial training, all LAEs and technicians are required to undergo continuation training every two years. The AAIB attended one such course. The training includes, but is not limited to: airworthiness procedures, the individual's scope of authority, human factors training and reporting quality deficiencies though the GFOR system.

1.17.15 Organisation and supervision of maintenance staff

In order to understand the behaviour and actions of the engineers and technicians involved in this incident, it is helpful to consider how the maintenance staff are organised and managed in the Airline's Maintenance Organisation.

The organisational structure of direct maintenance staff consists of, in increasing level of responsibility, mechanics, technicians and Licenced Aircraft Engineers. Mechanics do not hold any certification privileges and hence cannot certify for any work performed. Certifying Technicians hold limited authorisations and may only certify certain types of tasks. LAEs with their greater experience and more comprehensive training, have a much wider scope of responsibilities. This might include troubleshooting and rectification of aircraft defects, or responsibility for an aircraft zone during a maintenance check. The latter could involve the technical management of a crew of mechanics and technicians and the allocation of tasks to them. However this role is not widely perceived as being one of man-management and LAE's do not generally consider themselves to be responsible for the performance of the mechanics and technicians.

The responsibility for the management of maintenance staff rests with the Shift Manager, who is usually based in an office, which may be in the same hangar, or, in the case of the Ramp area, remote from where the work is being performed. The Shift Manager in 'TBD' Hangar Bay 13 was located in an office on the Mezzanine Floor. One Shift Manager, when consulted, stated that he had around 80 staff reporting to him in his hangar and that it was difficult for him to

54

effectively performance manage all of them. In his opinion it was important to have supervision on the shop floor.

1.17.16 Flight crew actions

The flight crew of G-CPER had acted decisively in donning their oxygen masks and establishing communications with each other in accordance with the emergency checklist.

Previously documented cases of oil fumes in the cockpit have resulted in various degrees of discomfort to flight crew and have in some cases caused partial incapacitation or impaired their judgement (AAIB Formal Report 1/2004 presents the findings of an extensive investigation into the problem of contamination of cockpit/cabin air supply by turbine oil fumes). Recognizing the potential risk, in December 2000, the UK CAA issued a Flight Operations Department Communication (FODCOM), number 17/2000, Appendix 3, which includes the following guidance:

'3.2.1 The first action in the event of smoke or fumes in the flight deck should be for the flight crew to don oxygen masks and establish communications'

1.18 New investigation techniques

None were used in this investigation.

55

2 Analysis

2.1 Roll control problem

Analysis of the flight recorder parameters showed that the flight controls were serviceable and functioning normally during the full and free control checks. The subsequent response of the aircraft to control inputs also appeared normal until the final approach to land at Gatwick. The requirement for significant control wheel inputs during this approach to land appears to be related to the selection of flap angles greater than 25°, when just under half of the available control wheel authority was necessary to maintain wings level flight. This is consistent with the fact that the leading edge of the fore-flap becomes exposed to the airflow at flap settings of 25° and above, when the effects of the discontinuity in the flap leading edge produced by the omission of the panels would begin to take effect.

Furthermore, given that the aircraft handling was normal on the flight test after the missing panels 666AR and 666BR had been reinstalled and that there have been no further reports of handling problems since the aircraft re-entered service, the roll control difficulties experienced during the flight were as a direct consequence of the asymmetric aerodynamic effects induced by the missing access panels on the right hand outboard flap.

The investigation therefore concentrated on the sequence of events that resulted in these panels being left off the aircraft.

2.2 Hot oil/electrical burning smells

No defects were found in any of the cabin utilities that could account for the electrical burning smell reported by cabin crew. The failure of the No 2 aft equipment cooling exhaust fan could be ruled out as a possible cause, given its remoteness from the cockpit and forward cabin where the smells were reported and the absence of evidence of overheating of the fan.

The hot oil smell in the cockpit was reproduced during the engine runs after the incident and as it was only present when the engine bleed air sources were selected, the problem was most likely associated with the engines. The strip examination of the left engine, removed because of high oil consumption, failed to identify any defects that could have produced the oil hot smells.

According to the aircraft manufacturer, Boeing Commercial Airplane Company, and the engine manufacturer, Rolls-Royce PLC, overfilling the engines with oil can cause hot oil smells in the cockpit and cabin. This is borne out by in-service

56

experience from Boeing 757 operators. This issue was also highlighted in AAIB formal report 1/2004 during which it was identified that the operator of G-CPER had the highest rate of reporting of oil smell incidents. The Powerplant Technical Department had taken extensive measures in trying to address the problem, including placarding the engine oil servicing access doors and issuing specific instructions and reminders to maintenance staff of the importance of complying with the Aircraft Maintenance Manual instructions.

Notwithstanding the above, the Maintenance Organisation's maintenance planning process did not take into account the Aircraft Maintenance Manual requirement to service the engine oils between 10 minutes and 1 hour of shutdown, so that the maintenance staff both in the hangars and on the Ramp were placed in a position where they often could not practically comply with the requirements.

2.3 Conduct of the maintenance

2.3.1 General

The technicians and LAEs involved in performing and/or certifying for the tasks of installing flap panels 666AR/BR and servicing the engine oils on G-CPER did not carry out the work to the required standard of airworthiness. This incident was the result of the failure to meet these standards.

The investigation found that the maintenance errors were not the result of willful negligence, or any desire to perform a less than satisfactory job, but the result of a combination of systemic issues, that had increased the probability of an error being committed. Both technicians had followed the accepted 'normal' practices in their work area and believed that they had acted correctly in doing so. Both individuals had shown commitment in performing their tasks and yet the tasks were not completed satisfactorily.

The procedures and instructions used for installing the wing access panels and servicing the engine oils were poorly engineered from a production engineering standpoint and were prone to cause error, however well performed, as this incident showed. The lack of consideration for the maintenance environment in planning these tasks was a major contributory factor.

A further contributory factor was the lack of oversight and guidance by the LAEs responsible for the technicians. This may be due to the fact that they do not have any supervisory responsibilities and they therefore do not see it as their job to monitor the actions of the technicians.

57

Whilst the LAEs and technicians involved were focused on completing the tasks in a timely and diligent manner, they did not seem to be aware of the implications on airworthiness of their actions and did not fully appreciate their responsibilities for ensuring compliance with the required airworthiness standards.

2.3.2 Procedure for controlling access panels

2.3.2.1 General

The practice of fitting and certifying for access panels as a 'batch' job, rather than sequentially would seem to be widespread practice within the Maintenance Organisation, given that this practice was in use at both the Heathrow and Gatwick maintenance bases. It was apparent that such a practice had evolved due to the remoteness of the job card racks from the work areas. Maintenance staff clearly perceived it to be more efficient to install all of the panels first, and then certify the job cards, rather than wasting time travelling back and forth to the job card racks on multiple occasions. Unsurprisingly, they had dealt with the more immediate problem of how to perform the task in the most economical manner, but they were not aware of the less obvious issue of the effect that this would have on the level of airworthiness control.

This incident, and that of the in-flight loss of the ADU access door on B777 G-VIIA, suggest that the Maintenance Organisation's procedures for the control of access panels are not sufficiently robust.

2.3.2.2 Flap panels 666AR and 666BR

The technician who certified for fitting these panels went to significant lengths to ensure that, in his view, the job was performed correctly. His decisions are not thought to have been affected by fatigue or environmental factors; he was influenced to a much greater degree by established working practices in the TBD Bay 13 hangar.

By certifying for the fitment of the panels, a task that he had not performed himself, the technician exceeded the scope of his company authorisation. However, the investigation determined that his was not an isolated case. The lack of discipline in certifying for work in a timely manner meant that it was not unusual for individuals to be in a position where they would be asked to certify for a task performed by someone else, who had gone off shift without certifying for the work completed. Faced with this problem, rather than incur potential delays in production, maintenance staff would attempt to verify that a task had been completed before certifying for it themselves. The logical response would

58

have been for supervision to manage their maintenance staff to ensure that all work was certified for as soon as it was completed, however, there were no staff acting in a supervisory capacity on the shop floor to take such action. Thus, a culture of 'blind stamping' job cards had developed, which after a period of time became accepted as 'normal' practice. The fact that this practice was prevalent at both the Heathrow and Gatwick maintenance bases, rules out the local culture within certain areas as being the primary causal factors. The problem of duplicate sets of panel job cards served to further encourage the practice of blind stamping, in that LAEs and technicians had become conditioned to expect to have job cards outstanding, even though all the maintenance tasks had been completed.

The technician's willingness to stamp off the job cards for installing panels 666AR and 666BR was thus a reflection of the 'normal' practices, rather than a wilful deviation from approved procedures and does not seem surprising given the above evidence. There is no reason to believe that another technician would not have done the same in his position.

Having misinterpreted the panel diagram, inspected the wing and found no evidence of missing panels, and being conditioned to 'expect' to see unstamped job cards for work already completed, the final link in the chain leading to the incident was the technician's assumption that the panels must already have been installed by another technician. This conclusion was almost inevitable given the picture of the situation in his mind at the time.

Notwithstanding his deviation from approved procedures, it could be argued that the incident was caused by the technician failing to recognise that the flap panels are hidden by the flap drive fairings when the flaps are retracted. However basic the error may appear with hindsight, such errors cannot be entirely eliminated from human performance and aviation history is filled with accidents caused by fundamental errors caused by misinterpretation or relying on assumption. It is recognised in the aviation industry that human error cannot be entirely eliminated and where an error could prove critical, systems and procedures are put in place to capture it or mitigate its effects. Examples of this include the cross-checking of instrument settings by both pilots, or duplicate inspections in maintenance on flight critical systems. There was no requirement for a duplicate inspection of the installation of panels 666AR/666BR and panels are not normally required to be duplicate inspected, these not being considered safety critical items.

The technician's error could have been caught had the flap panels 666AR/BR been found during the inspection of the hangar racking prior to the aircraft leaving the hangar. It was unfortunate that they had been placed with similar

59

looking slat panels that were not required to be refitted, hence the flap panels were overlooked.

2.3.3 Engine oil servicing procedures

The fact that technicians in the hangars and on the ramp would deviate from the Maintenance Manual instructions for servicing the engine oil without query, is a matter of concern. Even if they had not consulted the Maintenance Manual instructions, the intent of the instructions was included in the instruction sheet that forms part of the 'Daily Check' document, which clearly specified the time limits for checking the engine oil levels. The technicians appeared to have a mind set of simply performing the tasks as presented to them by their LAE or Shift Manager, without recourse to the Maintenance Manual instructions. It may be that they simply deferred to the instructions of their more experienced LAE/Shift Manager, or there may have been a general perception that the requirement to check the engine oils within the specified time period, was not really that important, given the basic nature of the task.

With the aircraft still in the hangar docking, the technician servicing the engine oils on G-CPER, had he followed the correct procedure, would have had to have taken positive action by deferring the oil servicing task until after the engine runs had been completed. Had he done so, the work might have been performed correctly on this occasion, but this could not be guaranteed the next time, and is this unacceptable from an airworthiness control standpoint. The random order in which the 'Daily Checks' were performed on the Ramp also resulted in failure to comply with the Maintenance Manual instructions. The absence of adequate maintenance planning to ensure that the engine oil levels were checked within the required time period in both heavy maintenance and operational areas constituted a systemic issue that rendered compliance with the approved instructions very difficult in some cases.

2.3.4 Behaviour and actions of the LAEs

2.3.4.1 Panels 666AR and 666BR

The Quality Investigation Report into the incident highlighted that the LAE had played a contributory role, by handing the technician a bunch of job cards to stamp. The technician's natural reaction was to follow the instructions of the LAE, he being far more experienced. It is not surprising that he failed to challenge the LAE's request when he was asked to clear the batch of panel cards handed to him, and had he done, it may not have been well received by the LAE. The LAE's actions in tasking the technician in this manner could be questioned, as with foresight it was likely to encourage him to stamp all of the panel job

60

cards handed to him, which is exactly what happened. It could also be asked as to why the LAE in charge of the task of re-panelling the right wing, who should have had a greater awareness of the airworthiness implications, did not ensure that the panels were installed sequentially, with each panel job card being stamped immediately after installing the panel. The fact that this did not occur seems to be a reflection on the general lack of discipline in the control of the fitment of access panels.

2.3.4.2 Certification for engine oil servicing task

It is a matter of concern that the LAE responsible for certifying for the engine oil servicing task on G-CPER certified for the task purely on the assumption that the technician had completed it correctly, particularly given that he observed the technician draining oil from the engines, which is not normal practice. The LAE's general lack of awareness of the technician's activities and the correct procedures for servicing the engine oils, specified in Alert Temporary Revision 12-593, had further compromised the standards of airworthiness.

2.4 The Maintenance Organisation's Quality Assurance Programme

The EQS department, through it's comprehensive procedures, scheduled auditing and Product Sampling programmes and the GFOR system complied with the JAR-145 requirements for an airline quality system. However, it was apparent that the department's level of oversight of activities in the TBD hangar and in operational areas was very limited. The ½ a day per month on average spent in the 'TBD' hangar was clearly insufficient time in which to gain a thorough understanding of the working practices being used and how they compared with the company's procedures. Quality compliance audits are not particularly effective in identifying behavioural issues that have the potential to compromise standards of airworthiness, as they look at the outputs of the processes and not necessarily how they are performed. These issues can only be understood through spending a suitable amount of time in the maintenance environment and working with staff to understand the factors that influence their working practices. It is therefore not surprising that the Quality Engineers were unaware of the actual practices in use on the shop floor and the detrimental effect that such practices might have on airworthiness control.

It was also apparent that the GFOR system and Product Samples in the 'TBD' hangar had not highlighted any problems relating to the control of access panels or the procedure for servicing the engine oils. These issues were either not perceived as being problems, or if they had been, they were not thought to be worthy of reporting via the quality system.

61

2.5 Supervision and organisation of hangar staff

The guidance and example set by supervision can have a strong influence on working culture. There was evidence of a lack of adequate leadership displayed by the LAEs involved with the G-CPER incident, in that they did not have sufficient oversight of how the tasks were being performed, and did not ensure that best practices were being used. They also displayed an over-willingness to rely on assumptions, rather than verify that work had been performed correctly.

This behaviour may simply be a reflection of the lack of clarity of the role that the LAEs are expected to play in terms of leadership, given that they have no responsibility for man-management and thus do not see it as being their job to monitor the performance of the technicians, nor to provide them with advice and instruction on best practice. The lack of discipline shown by technicians in certifying for work in a timely manner may have concerned the LAEs, but with no supervisory responsibility they would not have been in a position to take effective action against the problem. The fact that the composition of the maintenance crews changes with every aircraft input may be a further hindrance to maintaining consistent standards and practices. It is unrealistic to expect the Shift Manager to be able to achieve this, given the large number staff who report to him, his remoteness from the work face and his broader responsibilities.

It is not sufficient to issue maintenance staff with authorisations and expect that they will always stick to them rigidly whilst ignoring all external pressures and factors applied to them in the workplace; this is ignoring the influence of human factors. Simply relying on procedures and assuming that people will always adhere to them is unrealistic and can , over a period of time, result in a gradual shift in the norm away from best practice as people inevitably respond to the most pressing environmental and peer influences around them. This is a risk that is more apparent in a regime of Quality Assurance, where more responsibility is placed on the individual and there is less independent checking on the quality of individuals' work.

It was apparent that working practices had evolved in the 'TBD' hangar that were expedient in getting the job done, but not necessarily consistent with maintaining high standards of airworthiness and were in some cases deviating from approved company procedures. This was not a conscious, deliberate compromise of standards, but rather an invisible erosion of standards based on the more pressing need to 'get the job done' in as expedient a fashion as possible, which is a natural trait of engineers. The implications on standards of airworthiness of adopting certain procedures and methods are not always obvious at first sight and an awareness that standards might be compromised requires a certain degree of training, experience and awareness of airworthiness

62

issues in general. Without a continual focus on airworthiness standards, through training, effective supervision and adequate quality monitoring, it is inevitable that staff will deviate from best practices.

2.6 Similarities between the B777 (G-VIIA) and G-CPER incidents

The AAIB's investigation into the loss of a B777 (G-VIIA) ADU access door highlighted similar issues of lack of discipline and control of the certification of access panel tasks at the Airline's engineering base at London Gatwick. The issues of duplication of panel job cards, remoteness of the job card racks from the work area and staff failing to certify for work in a timely fashion were also identified in the G-VIIA investigation. Given that these findings were obtained by a different AAIB Inspector in independent investigation, the findings suggest that such issues may be widespread throughout the maintenance organisation. In this context, the technician's action in 'blind stamping' for fitting panels 666AR/BR on G-CPER seems not to have been an isolated case, but more symptomatic of the existing culture.

2.7 Conduct of the Maintenance Error Investigation

It is believed that no formal record of the MEI process on G-CPER was kept and thus the AAIB cannot comment on the method in which this was conducted.

It was clearly apparent, from comments received from a representative cross-section of maintenance staff, including technicians, LAEs and Shift Managers, that the Maintenance Organisation's MEI process was perceived as lacking in fairness and objectivity and was seen as being too closely tied to the disciplinary procedure. The staff believed that this was counterproductive to maintaining an open reporting culture.

The UK CAA's view on Maintenance Error Management systems is that if the lapse by the employee is unpremeditated or inadvertent, the employer would be expected to act reasonably in the interest of full and free reporting, so that the contributory factors to the incident can be established, with every effort being made to avoid action that may inhibit reporting.

The maintenance management's decision to take disciplinary action against the technician who certified for installing flap panels 666AR and 666BR, that he did not fit himself, seems inappropriate, given the significant systemic issues identified in both the AAIB's investigation and the EQS department's Quality Investigation. This is more so, given that the maintenance management were aware of and openly accepted the fact that 'blind-stamping' of maintenance tasks occurred.

63

Given that the technician did not display willful negligence and followed the 'accepted' working practices in his area, whilst exhibiting a desire to do a satisfactory job, the value of disciplinary action in this case seems to be questionable and in failing to address the underlying reasons for 'blind stamping' of job cards, is unlikely to have a long-term effect on staff behaviour.

2.8 Role of the Safety Services Department

The staff in the Safety Service's Department were well-motivated and saw their role as being important in providing an independent oversight of safety matters across the Airline. They believed that their task was not to apportion blame, but to help to identify and address the organisational issues that contributed to safety incidents, with the aim of preventing recurrence.

It appeared, however, that their effectiveness was limited in some areas by the lack of clarity in some of their departmental procedures and a lack of clarity over what authority and powers it held. For example, they believed that in the event of a serious incident occurring, the Safety Services department would lead the Airline's internal investigation, with this investigation taking precedence. This did not seem to be clearly reflected in procedures, and the Maintenance Organisation in any case did not seem to agree with this viewpoint, choosing to conduct their own independent investigation into the G-CPER incident.

Whilst the Airline's Operational Safety and Quality Management Manual specified that safety recommendations should be tracked via 'eBASIS' and the Board Safety Review Committee, there was no information provided on how to ensure that the responses to the safety recommendations were received in a timely manner. There was similarly no instruction on the action to be taken should the response to the recommendations be unsatisfactory. It is unsatisfactory that the department had placed safety recommendations on 'eBASIS' relating to improved procedures for the control of access panels and the servicing of the B757 engine oils, and for the Maintenance Organisation to have failed to provide a response in a timely manner.

It was apparent that, having conducted its own independent action into the incident, the Maintenance Organisation had taken it's own actions to address the issues. This is entirely appropriate and as it should be, however, it appeared to the AAIB that the safety management loop had not been closed in that the actions taken had not been formally recorded on 'eBASIS' and the Safety Services recommendations remained open with no response from the Maintenance Organisation.

64

It would seem appropriate for the Safety Services department to review its' working practices and procedures to ensure that more robust controls are put in place for monitoring safety issues and in particular, to ensure that it has sufficient authority to manage such issues to ensure satisfactory resolution from the Airline's perspective.

2.9 Consequences of failing to install or secure critical panels

The omission of the flap panels on G-CPER produced a significant detrimental effect on the handling of the aircraft. The size and weight of the ADU access door that detached from B777, G-VIIA was such that it could conceivably have caused significant damage to the aircraft or serious injury to persons on the ground. Such consequences suggest that the widely adopted industry view that the fitting and securing of access panels is not a critical task is not always valid. It would seem to be prudent that panels be considered as to their criticality, based on their size and location and the likely effects if they are either omitted, or should detach from the aircraft if incorrectly secured. It would seem reasonable that panels that could significantly hazard the aircraft or persons on the ground, should require an independent inspection after fitment or closure.

2.10 Flight crew actions

The flight crew made a positive decision to action the emergency checklist and don their oxygen masks in a timely manner. This was a prudent course of action, given that experience shows that pilot's well-being and judgement can be affected by exposure to engine oil fumes. Had they not taken this action, the subsequent handling difficulties on the final approach to London Gatwick could have been further compounded, increasing the degree of risk.

65

3 Conclusions

(a) Findings

1 The roll control problem on the approach to London Gatwick was caused by the asymmetric aerodynamic effects induced by the absence of flap access panels 666AR/666BR on the right wing outboard flap.

2 Access panels 666AR/666BR had not been replaced during recent maintenance.

3 The technician who incorrectly certified for fitting flap panels 666AR and 666BR was appropriately trained and qualified for the level of task being performed.

4 The technician responsible for certifying for the fitting of the flap panels had misinterpreted the panel diagram in the 757 Aircraft Maintenance Manual and did not recognize that the panels 666AR/666BR are hidden by the flap drive fairings when the flaps are retracted.

5 The same technician assumed incorrectly, after inspecting the right wing on a number of occasions and seeing no 'holes' in the wing, that flap panels 666AR/BR had already been fitted and proceeded to certify for their fitment.

6 In certifying for their fitment, the technician exceeded the scope of his certification privileges, as specified in company procedure TP-Q-8.1.1-01, in that he was only permitted to certify for work that he had performed.

7 The missing panels were not identified during an inspection of the hangar racks at the end of the maintenance activity.

8 The missing panels had been placed on the same shelf as panels removed from the leading edge slats that were similar in size and appearance and were not required to be refitted to the aircraft.

9 The missing flap panels, not being clearly visible when the flaps are retracted, were not noticed prior to the aircraft re-entering service, or during the pre-flight inspection prior to the departure from London Heathrow.

66

10 A non-procedural approach was used to refit the panels on the right wing whereby all of the panels were installed prior to stamping the job cards.

11 The remoteness of the job card racks from the work area encouraged a non-procedural approach to fitting the panels.

12 Maintenance staff frequently did not certify for tasks they had performed prior to going off shift, placing the responsibility on other maintenance staff and thereby encouraging the practice of 'blind stamping'

13 Maintenance staff were often willing to certify for tasks performed by others without verifying that the task had been completed correctly.

14 The culture of 'blind-stamping' was reinforced by the duplication of panel job cards.

15 Some maintenance staff did not fully appreciate the role that certification plays in the chain of airworthiness control.

16 No defects were found that could explain the oil/burning smells in the cockpit/cabin.

17 Incorrect procedures were used to service the engine oils during maintenance.

18 The incorrect servicing of the engine oils possibly caused the oil smells in the cockpit and cabin.

19 The technician who performed the 'Daily Check' engine oil servicing task and the LAE (Licenced Aircraft Engineer) who certified for the task were appropriately trained and qualified.

20 The technician who performed the engine oil servicing task did not comply with the Aircraft Maintenance Manual instructions.

21 The 'Daily Check' oil servicing task instructions were inappropriately engineered for an aircraft docked in a hangar on heavy maintenance and could not be accomplished practically in accordance with the Maintenance Manual instructions.

22 The LAE who certified for the oil servicing task did not have sufficient oversight of the task and certified for it's completion based purely on assumption that the task had been performed correctly.

67

23 Both the technician and the LAE involved in the engine oil servicing task exceeded the scope of their authorisation by certifying for work that had not been performed in accordance with approved procedures.

24 The 'Daily Check' engine oil servicing task was not being consistently performed on the ramp as a result of inadequate maintenance planning, which failed to ensure that the time limitations for engine oil servicing were complied with.

25 A culture existed within parts of the Airline's Maintenance Organisation in which LAEs and technicians deviated from approved maintenance instructions and company procedures, without being aware of the airworthiness implications and without a perceived need to seek approval from higher authority.

26 Ineffective supervision of maintenance staff had allowed working practices to develop that had compromised airworthiness control.

27 The Quality Assurance Programme was not wholly effective in highlighting unsatisfactory practices on the shop floor.

28 The established number of Quality Engineers and the broad scope of their responsibilities limited the amount of time they were able to spend in the maintenance environment.

29 There was no consistent policy in the Maintenance Organisation's approach to human factor's issues and its conduct of Maintenance Error Investigations (MEI).

30 Maintenance staff did not believe that the MEI process was objective and saw it as being a means only to effect disciplinary action.

31 The Maintenance Organisation took corrective action following the incident, however, this information was not entered on the Airline's 'eBASIS' safety database to enable the safety management loop to be closed.

32 The Maintenance Organisation had not responded in a timely manner to safety recommendations issued by the Safety Services department's 'BASI 4' investigation into this incident.

68

33 The Safety Services department's method for tracking safety recommendations to ensure the implementation of timely and appropriate safety actions lacked robustness.

34 The Airline's 'BASI 4' procedure lacked clarity in defining that the Safety Services department's investigation took precedence over other company investigations, with the result that two independent, uncoordinated investigations were carried out.

35 The management of quality standards had been heavily devolved to the various sections of the Airline, with a limited degree of central control.

(b) Causal Factors

The following causal factors were identified:

1 The tasks of refitting the panels to the right wing and correctly certifying for the work carried out were not performed to the required airworthiness standard.

2 Ineffective supervision of maintenance staff had allowed working practices to develop that had compromised the level of airworthiness control and had become accepted as the 'norm'.

3 There was a culture, both on the ramp and in the maintenance hangar, which was not effective in ensuring that maintenance staff operated within the scope of their company authorisation and in accordance with approved instructions.

4 The maintenance planning and task instructions, relating to oil servicing on the Boeing 757 fleet, were inappropriate and did not ensure compliance with the approved instructions.

5 The Airline's Quality Assurance Programme was not effective in highlighting unsatisfactory maintenance practices.

69

4 Safety Recommendations

The following safety recommendations are made as a result of this investigation:

4.1 Safety Recommendation 2005-116: British Airways Maintenance Organisation should take suitable action to ensure that maintenance tasks are certified for in a sequential and timely manner. All maintenance staff should also be reminded of their professional responsibilities, the limit of their authorisation, and that approval from the appropriate authority is required when it becomes necessary to deviate from approved instructions and procedures.

4.2 Safety Recommendation 2005-117: British Airways Maintenance Organisation should review job card rack placement ergonomics to ensure that their positioning does not have a detrimental effect on the sequential and timely certification of maintenance tasks.

4.3 Safety Recommendation 2005-118: British Airways Maintenance Organisation should review their 'Maintenance Error Investigation' process, in order to ensure consistency, traceability and accountability in its application, with a view to restoring the confidence of maintenance staff in the process.

4.4 Safety Recommendation 2005-119: British Airways Maintenance Organisation should review the level of supervision on the 'shop floor' to satisfy itself that it is adequate to maintain the required standards of airworthiness.

4.5 Safety Recommendation 2005-120: British Airways should review their structure and procedures for the management of quality, to satisfy themselves that there is sufficient degree of centralised control over the standards of quality within each section of the organisation.

4.6 Safety Recommendation 2005-121: British Airways Maintenance Organisation should review its maintenance planning and production control procedures, for the servicing of B757 engine oils, to ensure compliance with the Aircraft Maintenance Manual at all times, in both operational and heavy maintenance environments.

4.7 Safety Recommendation 2005-122: British Airways Maintenance Organisation should take suitable actions to ensure that the Engineering Quality Services department has a better oversight and understanding of the day to day practices in the areas where maintenance is carried out.

4.8 Safety Recommendation 2005-123: The European Aviation Safety Agency (EASA) should consider introducing a requirement to carry out a duplicate inspection on aircraft access panels, removed and refitted or opened and closed as part of a maintenance procedure, that could significantly affect airworthiness if incorrectly secured and should they detach in flight, endanger either the aircraft, or persons on the ground.

70

5 Airline's response to Safety Recommendations

5.1 Safety Recommendation 2005-116

British Airways Maintenance Organisation should take suitable action to ensure that maintenance tasks are certified for in a sequential and timely manner. All maintenance staff should also be reminded of their professional responsibilities, the limit of their authorisation, and that approval from the appropriate authority is required when it becomes necessary to deviate from approved instructions and procedures.

- Recommendation agreed and implemented.

The Airline has taken the following actions:

• A briefing was given to all staff in base maintenance regarding the necessity of certifying task cards sequentially and in a timely manner.

• Measures have been taken to raise awareness of incidents that occur during maintenance and provide open forums to discuss preventative action taken, including:

- LAE Safety Symposium, attended by over 600 certifying staff and their local management

- Systems and Procedures booklet issued to all 6,000 staff in Engineering describing systems for safeguarding maintenance standards

- Examples of maintenance errors included in bi-annual Continuation Training for certifying staff as awareness of human error events

- Distribution of a monthly Airworthiness Bulletin to all staff in Engineering which discusses key issues of maintenance error and its causes

- Addition of an engineering related section in the 'Flywise' periodical issued to all flight crew to review significant maintenance issues.

71

5.2 Safety Recommendation 2005-117

British Airway's Maintenance Organisation should review job card rack placement ergonomics to ensure that their position does not have a detrimental effect on the sequential and timely certification of maintenance tasks.

- Recommendation reviewed and implemented.

British Airways carefully reviewed this recommendation, but overall remain concerned that implementing a number of locally controlled card locations as a solution rather than a central card control system is considered as a higher risk strategy, which is more than likely to lead to mis-laid or overlooked task cards.

Since the incident on G-CPER, the 'TBD' maintenance hangar has been closed and the maintenance relocated. During the facility refurbishment the location of all task card racking was given careful consideration to ensure that it is placed in the most effective position on and around the maintenance docking. This review addresses the ergonomics issue highlighted.

On completion of the facility upgrade, a risk assessment was carried out by the Quality department to ensure that all relevant areas of the EASA Part 145 code were reviewed and outcomes found to be acceptable before start up of the new facility.

5.3 Safety Recommendation 2005-118

British Airways Maintenance Organisation should review their 'Maintenance Error Investigation' process, in order to ensure consistency, traceability and accountability in it's application, with a view to restoring the confidence of maintenance staff in the process.

- Recommendation reviewed and implemented.

All staff in Engineering have been apprised of the MEI process in a booklet distributed to each individual. The process has been reviewed and clarity provided for management and staff as to how and when MEI is applied.

The amended process chart now clearly identifies when the MEI procedure is invoked as part of the event investigation process, and is only carried out by staff trained in its use.

72

The Maintenance Safety Group previously described to the AAIB, has discussed and endorsed the amended process, which has been formally adopted in Engineering procedures available on-line to all Engineering staff.

5.4 Safety Recommendation 2005-119

British Airways Maintenance Organisation should review the level of supervision on the 'shop floor' to satisfy itself that it is adequate to maintain the required standards of airworthiness.

- Recommendation reviewed and implemented.

All full review regarding the role and responsibilities for enhanced supervision of maintenance standards has been carried out. The review has included the scope of technical decision-making, responsibilities for team leadership and supervision of maintenance standards. Additionally a review of feedback from LAE's following maintenance incidents, together with visits to other BA partner airlines, to carry out 'best practice' reviews of LAE duties has been carried out.

Implementation of the enhanced supervisory role is expected in Autumn 2005, this will provide a clear definition regarding the scope of LAE responsibilities, including renaming of the grade as 'Maintenance Supervisor' to differentiate from other certifying grades who are licence holders. The supervisory function will provide team leadership and technical guidance to less experienced maintenance staff, and will ensure that all activities are certified at the appropriate level by the staff involved in maintenance tasks. Formally recognising the supervisory level as part of the management of maintenance activity will also provide a defined line of communication between hangar management and staff performing tasks on the aircraft.

5.5 Safety Recommendation 2005-120

British Airways should review their structure and procedures for the management of quality, to satisfy themselves that there is sufficient degree of centralised control over the standards of quality within each section of the organisation.

- Recommendation reviewed and implemented.

73

Since the incident, Safety Services as a department has been expanded to include Corporate Quality and has been renamed as Corporate Safety & Quality. The Corporate Quality activities have included the creation of the Operational Safety & Quality Management Manual (OSQMM), which has been accepted as the Airline's JAR-Ops Quality Manual by the CAA. This first issue was published on 30 June 2004. Corporate Quality has also revised and re-issued the Airline's Safety & Quality Policy Manual on behalf of the Chief Executive.

Following the publication of the OSQMM, Corporate Quality has instigated Safety & Quality reviews of operational and related departments in the Airline. To date, reviews have been conducted in Ground Operations, Cargo, Inflight Service (Cabin Crew and Catering), Engineering and Flight Operations. Reviews are also underway with Procurement (purchasing) and Training. The summary report of these reviews, delivered to the Accountable Manager's Meeting in May 2005, proposed further review of the Safety & Quality organisations across the Airline due to the differences in structures. This review is currently underway with benchmarking visits to a number of large airlines in the UK and Europe. This review will report to the next Accountable Manager's Meeting in September 2005 and intends to include proposed plans for implementing changes to the Airline organisation and responsibilities.

5.6 Safety Recommendation 2005-121

British Airways Maintenance Organisation should review its maintenance planning and production control procedures, for the servicing of B757 engine oils, to ensure compliance with the Aircraft Maintenance Manual at all times, in both operational and heavy maintenance environments.

- Recommendation reviewed and implemented.

a) Maintenance procedures have been reviewed and amended to provide clear instructions on requirements for oil servicing in the operating area and following extended periods when the engine has not been operating.

b) To remove any ambiguity for oil servicing, modification 10002944 has been embodied to provide clear markings on the oil level sight glass, and mod 10002961 embodied fitting an explanatory decal.

c) To provide our crew with improved guidance on scope for acceptable engine oil levels during the operating day, the B757

74

Operations Manual (Flying Manual) has been amended as below to ensure that engineers are not called upon to unwittingly overfill the engines.

d) A focus for engineers on problems of B757 engine oil servicing has been provided through a series of Quality Alert Bulletins issued by the Quality department.

The following summary is provided of Quality oversight of maintenance practices. Several actions have been taken within British Airways Engineering to address concerns raised over B757 oil servicing since G-CPER's diversion into LGW on the 07/09/03, following reports of oil smells on the flight deck.

Immediately following the incident, a Technical News was issued by the Powerplant Technical department to advise all certifying Engineers of the need to adhere to the following:

• Service engine oils between defined time intervals after engine shutdown.

• Awareness that British Airway's full limits are one litre less than the manufacturers full limit.

• Awareness that oil servicing requirements are contained in Alert Temporary Revisions.

• Ensure that oil uplifts are correctly recorded in the Technical log.

In addition, Engineers attention was drawn to the Alert Temporary Revisions for oil servicing through awareness on the monthly Fleet 1 Quality hangar displays in September and November 2003.

In February 2004, a task audit conducted by Fleet 1 Quality sampled engine oil servicing standards at Terminal 1 and highlighted that defined time intervals for servicing (between 10 and 60 mins after engine shut-down) were not being adhered to in all cases. Non-conformances were duly responded to, which included a corrective action for Engineers to make a certifiable Technical log entry to record engine shutdown and oil servicing times. The B757 Daily Check sheets were amended to incorporate this requirement and a Quality Alert Bulletin, together with a further article on the April 2004 Fleet 1 Quality hangar display, were issued to raise awareness of the new requirement.

75

In September 2004, Powerplant issued a further Technical News, which publicised the following:

• Incorporation of colour coding on the engine sight glass through incorporation of a British Airways Service Bulletin to minimise servicing errors.

• Amendment to the British Airways maximum oil level of two litres down from full.

• Amendment of the Alert Temporary Revisions to incorporate the above requirements.

In conjunction with the Technical News, Powerplant also carried out a series of presentations to Production areas to raise awareness of the issues surrounding B757 oil servicing.

Although reports of oil smells in-flight dramatically reduced, two further task audits carried out by Fleet 1 Quality in January and May 2005 highlighted that some Engineers at both LHR and European Line Stations were not making the requisite Technical log entry for engine shutdown and oil servicing times. In addition, some recorded uplifts were still being recorded above the British Airways limit, as specified in the Alert Temporary Revisions. These audits have been closely monitored at the Fleet 1 Quality Forum and through awareness and oversight by the Terminal 1 and Line Maintenance Managers, sufficient improvements to oil recording have been made to allow the action for regular oversight to be closed at the July 2005 Forum. Standards will continue to be monitored during the quarterly production area audits.

5.7 Safety Recommendation 2005-122

British Airways Maintenance Organisation should take suitable actions to ensure that the Engineering Quality Services department has a better oversight and understanding of the day to day practices in the areas where maintenance is carried out.

- Recommendation reviewed and implemented.

The AAIB investigation report states that ½ day per month, on average, is spent in the work area by Quality Department staff. This statement does not fully reflect the actual time spent by Quality Department staff in the completion of oversight duties in the work area. The current

76

audit schedule regarding tasks during maintenance and the audits previously reported identify that approximately 30% of the departments manpower is allotted to audit activity - the 2004 schedule identified 73 aircraft audits carried out as an example.

It should be noted that the report comment regarding compliance auditing does not appear entirely accurate, as this type of audit focuses on maintenance processes, rather than necessarily how tasks are performed.

Due to promotions and retirements resulting in staff movements, manpower in the Quality department is currently under review to ensure that optimum numbers are maintained. Accordingly the department is currently engaged in recruitment of additional staff to ensure that appropriate resources are available to conduct and maintain adequate levels of surveillance within the maintenance areas (ie in the actual work place as suggested).

To ensure that all maintenance areas have a good understanding of where working practices can be improved, feedback from Quality Audits is provided at monthly Quality Forums, chaired by the respective owning General Manager. As an additional focal point a Key Quality Initiative was raised on common audit findings which is regularly reviewed at the weekly GM Safety and Quality meeting and this links to actions taken by owning General Manager's for each of the areas concerned.

D S Miller Deputy Chief Inspector of Air Accidents Air Accidents Investigation Branch Department for Transport November 2005

Appendix 1

Job Cards for fitment of R/H outboard flap panels 666AR and 666BR

Appendix 2

Daily Check Inspection Sheet (engine oil servicing task highlighted)

Appendix 2

Daily Check Inspection Sheet (oil servicing requirements highlighted)

Appendix 3

Boeing 757 AMM Panel Chart showing location of Panels 666AR and 666BR

(Diagram reproduced by permission of the Boeing Company)

Appendix 4

Boeing 757 AMM Panel Chart showing location of Panels 666AR and 666BR

(Diagram reproduced by permission of the Boeing Company)

Unless otherwise indicated, recommendations in this report are addressed to the regulatory authorities of the State having responsibility for the matters with which the recommendation is concerned. It is for those authorities to decide what action is taken. In the United Kingdom the responsible authority is the Civil Aviation Authority, CAA House, 45-49 Kingsway, London WC2B 6TE or the European Aviation Safety Agency, Postfach 10 12 53, D-50452 Koeln, Germany.